CERT24GHSA-c72h-82w6-rqfp — wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)Loading data…
CERT24Threat Observatory
Period

GHSA-c72h-82w6-rqfp — wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

A flawed gym-scope guard in five wger gym-management views allows a trainer with gym=None and the required permissions to read private data belonging to other users who also have gym=None.

← Back to intelligence

GHSA-c72h-82w6-rqfp — wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)

A flawed gym-scope guard in five wger gym-management views allows a trainer with gym=None and the required permissions to read private data belonging to other users who also have gym=None.