Delegated-trainer account takeover via null gym comparison

Incorrect authorization in wger before 2.6 allows remote authenticated users with gym management rights to take over unaffiliated accounts. The reset_user_password view compares gym objects with !=, so two null gym assignments bypass the scope guard and the response returns the victim's new plaintext password. Exploitation requires gym.manage_gym permission and no gym assignment for both accounts; it invalidates the victim's old password and enables immediate impersonation.