Before version 2.6, users with the gym_trainer permission in wger could deactivate any account in the same gym, including those with higher privileges such as gym_manager or general_gym_manager. The privilege escalation occurs because the UserDeactivateView allows access to anyone holding gym.manage_gym, gym.manage_gyms, or gym.gym_trainer (OR logic) and does not enforce a privilege‑hierarchy check. This flaw enables a lower privileged role to disable higher privileged accounts, undermining the access control model represented by CWE‑269.

The vulnerability affects the wger open‑source workout manager released by wger-project:wger. All versions prior to 2.6, including 2.5 and earlier, are vulnerable. Version 2.6 introduces a fix that validates role hierarchy before allowing deactivation.

The CVSS score of 7.1 indicates a high‐severity privilege escalation. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation reported yet. Attackers must possess valid credentials with gym_trainer permission and operate within a gym context to exploit the flaw. The OR logic means any one of the three permissions grants deactivation rights, so if gym_trainer is broadly assigned the risk of privilege abuse is significant. The lack of an automatic privilege hierarchy check makes this a classic example of improper authorization control.