A vulnerability in the wger fitness manager allows any authenticated user to perform unauthorized modifications to global configurations, leading to potential vertical privilege escalation.

The application incorrectly inherits from WgerFormMixin instead of WgerPermissionMixin in the GymConfigUpdateView, causing the intended permission check for the global gym configuration to be bypassed. This allows any authenticated user to perform unauthorized administrative actions, including bulk-updating user profile gym assignments.

This vulnerability represents a significant security risk as it allows for the manipulation of global application settings. Successful exploitation could lead to unauthorized administrative control over the platform, resulting in integrity compromise, potential data manipulation across user profiles, and a loss of confidence in the application's access control architecture. With a CVSS score of 7.6, this flaw is categorized as High severity due to the potential for unauthorized configuration changes.

Immediate Action: Upgrade the wger installation to version 2.5 or higher, which includes the necessary code changes to enforce the required permission checks.

Proactive Monitoring: Review application access logs for unusual administrative activity or changes to gym configuration settings performed by standard user accounts.

Compensating Controls: Implement strict network access controls or a Web Application Firewall (WAF) to restrict access to the administrative endpoints associated with gym configuration updates until the patch is applied.

Public Exploit Available: Unknown.

Given the potential for vertical privilege escalation and unauthorized administrative control, administrators should prioritize updating to version 2.5 immediately. Failure to apply this update leaves the application susceptible to configuration tampering by any authenticated user, which could have widespread impacts on user data integrity.