The vulnerability resides in wger’s core view handlers where a legacy integer equality check is used instead of the is_same_gym() helper. This oversight means that staff with a null gym affiliation (gym=None) can bypass the intended gym‑scoped restrictions and delete, deactivate, or activate any user who also has a null gym affiliation. This capability is effectively an authorization escalation that allows an attacker to permanently remove or lock out other users, reversing defense mechanisms.

The issue affects all wger-project:wger releases that use the vulnerable master branch. No specific version numbers are supplied, but any build that includes the unpatched master code is susceptible.

With a CVSS score of 6.1, the vulnerability is considered moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating no known active exploits at this time. However, exploitation requires the attacker to hold gym.manage_gym permission and belong to a null gym affiliation, conditions that may be present in some deployments. Once those prerequisites are met, the attacker can delete or deactivate user accounts, causing loss of availability and potential data loss.