The flaw lies in the way the wger application performs a gym‑scope authorization check for password reset and gym permission editing. The code uses a Python object comparison that evaluates None != None as False, causing a silent bypass of the check when both the attacker and the victim have no gym assignment (gym=None). An attacker who has the gym.manage_gym permission but is not associated with any gym can therefore reset the password of any other user who also has no gym assignment. The new password is returned in clear text within the HTML response body, giving the attacker immediate full control of the victim’s account and permanently locking the victim out by invalidating their original password. This is a classic example of inadequate authorization, CWE‑863, and results in complete compromise of user credentials.

The vulnerability affects the open‑source wger workout and fitness manager provided by wger‑project, including any version prior to 2.6. Any installation that has not upgraded to the fixed 2.6 release is susceptible, regardless of deployment environment.

With a CVSS score of 9.9, this issue is considered critical. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog, but the high severity indicates that exploitation would have severe consequences. The attack can be carried out through the web UI: an authenticated user who possesses gym.manage_gym permission and has no gym assigned can trigger the vulnerable view. No additional conditions, such as elevated privileges or remote network access, are required beyond the existing permission. As the vulnerability enables one‑shot account takeover, the risk to affected sites is extremely high.