Affected: wger-project wger

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced at runtime. Since GymConfig is an ownerless singleton, any authenticated user can modify the global gym configuration, triggering save() side effects that bulk-update user profile gym assignments — a vertical privilege escalation to installation-wide configuration control. This issue is fixed in version 2.5.

Affected: PyPI: wger

## Summary

wger exposes a global configuration edit endpoint at `/config/gym-config/edit` implemented by `GymConfigUpdateView`. The view declares `permission_required = 'config.change_gymconfig'` but does not enforce it because it inherits `WgerFormMixin` (ownership-only checks) instead of the project’s permission-enforcing mixin (`WgerPermissionMixin`) .

The edited object is a singleton (`GymConfig(pk=1)`) and the model does not implement `get_owner_object()`, so `WgerFormMixin` skips ownership enforcement. As a result, a low-privileged authenticated user can modify installation-wide configuration and trigger server-side side effects in `GymConfig.save()`.

This is a vertical privilege escalation from a regular user to privileged global configuration control. The application explicitly declares permission_required = 'config.change_gymconfig', demonstrating that the action is intended to be restricted; however, this requirement is never enforced at runtime.

## Affected endpoint

The config URLs map as follows.

File: `wger/config/urls.py`

```python patterns_gym_config = [ path('edit', gym_config.GymConfigUpdateView.as_view(), name='edit'), ]

urlpatterns = [ path( 'gym-config/', include((patterns_gym_config, 'gym_config'), namespace='gym_config'), ), ] ```

This resolves to:

`/config/gym-config/edit`

## Root cause

### The view declares a permission but does not enforce it

File: `wger/config/views/gym_config.py`

```python class GymConfigUp…