The wger open-source workout and fitness manager has a privilege escalation vulnerability (CWE-269) in versions prior to 2.6. A gym trainer can exploit the trainer-login endpoint by first switching to a low-privileged user, which sets a session flag 'trainer.identity'. This flag bypasses permission checks on subsequent trainer-login calls, enabling the attacker to escalate privileges to gym manager or general manager roles. This grants unauthorized access to sensitive member data, contract modifications, gym configuration, and personal information of other trainers and managers. The vulnerability is resolved in wger version 2.6.

Exploitation allows a gym trainer to gain full administrative privileges, including viewing and modifying sensitive member and contract data, managing gym configurations, and accessing personal information of other users. This compromises confidentiality and integrity of the system data but does not affect availability.

Upgrade to wger version 2.6 or later, where this privilege escalation vulnerability has been fixed. No other mitigation is indicated by the vendor advisory.