The GymConfigUpdateView incorrectly inherits the permission mixin, causing the declared permission 'config.change_gymconfig' to never be checked at runtime. Any authenticated user can therefore change the global gym configuration, triggering side effects that bulk‑update all user gym assignments. The attacker thereby gains installation‑wide configuration control, a form of vertical privilege escalation that bypasses the intended access restrictions.

This issue affects all releases of wger prior to the 2.5 release. The mitigation was applied in version 2.5, which replaces the incorrect mixin with the proper permission enforcement logic. System administrators should verify the installed version and upgrade accordingly.

With a CVSS score of 7.6 the vulnerability is considered high severity; it requires the attacker to be authenticated, which is a low barrier for any user. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet. Nonetheless, because any logged‑in user can modify global settings that affect all users, the potential impact on integrity and availability is significant, and the vulnerability should be treated as a priority for remediation.