Threats tagged 'ghsa-9qpr-vc49-hqg2'

A privilege escalation vulnerability in wger allows a gym trainer to impersonate higher-privileged accounts such as gym managers by chaining calls to the trainer-login endpoint. This occurs because a session flag set during a legitimate trainer login bypasses permission checks on subsequent trainer-login calls, enabling unauthorized account switching. The flaw is due to a logical error in the permission check condition in the source code. Exploiting this vulnerability grants full gym administration capabilities including access to sensitive member data and management functions.