CVE-2026-46434

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permission can deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding any one of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic via `WgerMultiplePermissionRequiredMixin`), and performs no privilege-hierarchy check to prevent a lower-privileged role from disabling a higher-privileged one. Version 2.6 fixes the issue.

• CWE-269

• https://github.com/wger-project/wger/releases/tag/2.6
• https://github.com/wger-project/wger/security/advisories/GHSA-x249-cx55-2h87
• https://github.com/wger-project/wger/security/advisories/GHSA-x249-cx55-2h87

Published

Oct 7, 2026

Last Modified

Oct 7, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46429GeoNode is a geospatial content management system, a platfor…5.5
• CVE-2026-4643Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to…3.5
• CVE-2026-46430Algernon is a small self-contained pure-Go web server. Prior…4.3
• CVE-2026-46431Algernon is a small self-contained pure-Go web server. Prior…4.3
• CVE-2026-46432LMDeploy is a toolkit for compressing, deploying, and servin…7.8
• CVE-2026-46433lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to …6.5
• CVE-2026-46437wger is a free, open-source workout and fitness manager. Ver…4.8
• CVE-2026-46438wger is a free, open-source workout and fitness manager. Pri…6.5
• CVE-2026-46439compliance-trestle is a tooling platform for managing compli…7.8
• CVE-2026-4644A Missing Authorization vulnerability in HTTP Connector in G…8.5
• CVE-2026-46440Flowise is a drag & drop user interface to build a customize…9.1
• CVE-2026-46441Flowise is a drag & drop user interface to build a customize…9.6