CVE-2026-86254: Missing Authorization in wger-project wger

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py. Three views use raw integer comparison instead of the is_same_gym() helper, causing a None != None comparison edge case. This flaw allows gym staff with gym=None and gym.manage_gym permission to perform unauthorized actions such as permanently deleting user accounts, deactivating users, or reactivating users with gym=None affiliation. The vulnerability arises from improper gym-scope checks that fail to correctly restrict actions to the same gym context.

Attackers with gym.manage_gym permission and gym=None affiliation can exploit this vulnerability to permanently delete user accounts, lock out users by deactivation, or undo defensive deactivations for users with gym=None. This compromises user account integrity and availability within the affected wger installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict gym.manage_gym permissions carefully, especially for users with gym=None affiliation, to limit potential exploitation.