CVE-2026-46434

{
  "etk_id": "ETK-2026-2532",
  "cve_id": "CVE-2026-46434",
  "display_id": "CVE-2026-46434",
  "ghsa_id": "GHSA-x249-cx55-2h87",
  "euvd_id": null,
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "Improper role authorization in wger account management",
  "summary": "Affected wger deployments allow an authenticated gym trainer to activate or deactivate accounts in the same gym, including managerial accounts. Exploitation requires a trainer-level account and a target account associated with that gym.",
  "mitigation": "Restrict trainer access to account activation and deactivation functions, such as by blocking the affected routes or removing the relevant permissions, and review account status changes for affected gyms. Apply an upstream correction when one is released; no fixed version is recorded.",
  "vendor": null,
  "product": "pip:wger",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 2.1"
      ],
      "ecosystem": "pip",
      "fixed_versions": [],
      "package_name": "wger",
      "purl": "pkg:pypi/wger"
    }
  ],
  "cwes": null,
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": null,
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": null,
  "t0_at": "2026-10-07T13:55:19.566000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T13:55:19.566000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T13:55:19.566000+00:00",
      "url": "https://github.com/advisories/GHSA-x249-cx55-2h87"
    }
  }
}