Threats tagged 'ghsa-x249-cx55-2h87'

A privilege escalation vulnerability in wger allows a user with the gym_trainer role to deactivate accounts of other users within the same gym, including those with higher privileges such as gym_manager and general_gym_manager. This occurs because the UserDeactivateView grants access if the user has any one of several permissions, including gym.gym_trainer, without verifying privilege hierarchy. Consequently, trainers can deactivate managers' accounts, effectively locking them out. The same issue exists in UserActivateView. The vulnerability affects wger versions up to and including 2.1 and has a CVSS score of 7.1 (high severity).