CVE-2026-86254 wger-project CVE debrief

Who should care

Defenders responsible for wger installations, especially those with elevated gym staff permissions, should assess exposure and prioritize mitigation. This includes verifying wger installations for vulnerability to CVE-2026-86254, restricting gym staff permissions to prevent unauthorized user actions, and monitoring user accounts for suspicious activity. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and close the item only after evidence is documented. Operators, platform administrators, vulnerability management teams, and security teams should also be aware of the potential impacts and take necessary actions to protect their systems and data. This may involve applying patches or updates to wger installations as available, and ensuring that gym staff permissions are properly managed and monitored. By taking these steps, defenders can help prevent unauthorized user actions and protect their systems from potential exploitation of this vulnerability. The CVE record and source references indicate an incomplete authorization bypass in wger versions through master, allowing gym staff with gym=None to delete, deactivate, or activate any other user with gym=None. Therefore, it is essential to verify and mitigate this vulnerability in wger installations, especially where gym staff have elevated permissions. This can be achieved by verifying wger installations for vulnerability to CVE-2026-86254, restricting gym staff permissions, and monitoring user accounts for suspicious activity. Furthermore, defenders should consider the operational impacts of this vulnerability, including permanent deletion of user accounts, lockout of users via deactivation, and undoing of defensive deactivations. By prioritizing mitigation and taking necessary actions, defenders can help protect their systems and data from potential exploitation of this vulnerability. The incomplete authorization bypass in wger versions through master allows gym staff with gym=None to delete, deactivate, or activate any other user with gym=None, which can lead to permanent deletion of user,

Why it matters

CVE-2026-86254 is a medium-severity vulnerability in wger that allows unauthorized gym staff to delete, deactivate, or activate user accounts. Defenders responsible for wger installations should assess exposure and prioritize mitigation to prevent unauthorized user actions.

• Permanent deletion of user accounts by unauthorized gym staff
• Lockout of users via deactivation by unauthorized gym staff
• Undoing of defensive deactivations by unauthorized gym staff
• Verification of wger installations for vulnerability to CVE-2026-86254

Technical summary

CVE-2026-86254 is an incomplete authorization bypass in wger versions through master. The vulnerability exists in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is_same_gym() helper. This allows gym staff with gym=None to delete, deactivate, or activate any other user with gym=None. Attackers with gym.manage_gym permission and gym=None affiliation can exploit this vulnerability to permanently delete user accounts, lock users out via deactivation, or undo defensive deactivations.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in wger installations, especially where gym staff have elevated permissions.

Recommended defensive actions

• Verify wger installations for vulnerability to CVE-2026-86254
• Restrict gym staff permissions to prevent unauthorized user actions
• Monitor user accounts for suspicious activity
• Apply patches or updates to wger installations as available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references indicate an incomplete authorization bypass in wger versions through master, allowing gym staff with gym=None to delete, deactivate, or activate any other user with gym=None.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.