Threats tagged 'ghsa-c72h-82w6-rqfp'

wger contains an access control vulnerability affecting five gym management views where a gym-scope guard fails when both the requesting trainer and target user have no gym assigned (gym=None). This flaw allows an authenticated trainer with specific permissions and no gym assignment to access private admin notes, documents, contracts, user configurations, and permissions of any other unaffiliated user with gym=None. The root cause is a comparison that incorrectly allows access when both gym values are None, combined with querysets that lack secondary gym-scoped filtering.