CVE-2026-54670
CriticalCVSS 9.1Summary
In WeGIA prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive ContribuicaoLogController operations from authentication, and constructs a controller include path without canonical directory containment. An unauthenticated attacker can invoke sensitive methods, disclose contribution and donation records, trigger financial operations, and include files outside the intended controller directory.
Risk Assessment
An attacker can disclose donor and contribution data, trigger financial operations, and read source code or credentials from configuration files.
Recommendation
Update WeGIA to version 3.8.5 or later and verify that the controller and method allowlist is complete.
Other vulnerabilities in WeGIA
See all- CVE-2026-54671High
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5.
- CVE-2026-23723High
WeGIA is a web manager for charitable institutions. Prior to version 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaControle endpoint via the id_memorando parameter. This flaw allows for full database exfiltration, exposure of sensitive PII, and potential arbitrary file reads in misconfigured environments. This vulnerability is fixed in 3.6.2.
- CVE-2026-54767Critical
In WeGIA (a web manager for charitable institutions) prior to 3.8.5, the deletar_socios.php endpoint is accessible without authentication, and its chave parameter is checked only against a hardcoded value embedded in the public repository. An attacker who knows that value can trigger TRUNCATE TABLE operations on the endereco, pessoafisica, pessoajuridica, and socio tables, permanently destroying member and contributor records.
- CVE-2026-23722Critical
WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WeGIA system, specifically within the html/memorando/insere_despacho.php file. The application fails to properly sanitize or encode user-supplied input via the id_memorando GET parameter before reflecting it into the HTML source (likely inside a <script> block or an attribute). This allows unauthenticated attackers to inject arbitrary JavaScript or HTML into the context of the user's browser session. This vulnerability is fixed in 3.6.2.
- CVE-2026-76634Medium
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all user identifiers to retrieve full profile data for any employee account, including name, CPF, address, contact details, and administrative flags.
- CVE-2026-76633High
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.
- CVE-2026-35475Medium
WeGIA prior to version 3.6.9 contains an open redirect vulnerability. The 'redirect' parameter taken from the GET request is not validated or whitelisted, then used directly in a Location header. An attacker can redirect users to a malicious site.
- CVE-2026-35474Medium
WeGIA before version 3.6.9 contains an open redirect vulnerability. The 'redirect' parameter is taken directly from $_GET without URL validation and used in a Location header, allowing redirection to arbitrary external sites.
- CVE-2026-35473Medium
WeGIA before version 3.6.9 has an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the 'nextPage' parameter. The application fails to validate this parameter, allowing attackers to redirect users to arbitrary external sites.
- CVE-2026-35472Medium
WeGIA before version 3.6.9 contains an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle. The parameter is not validated, allowing redirection to arbitrary external websites.
Original NVD description (English source)
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive ContribuicaoLogController operations from authentication, and constructs a controller include path without canonical directory containment. An unauthenticated remote attacker can invoke getContribuicoesLogJSON, sincronizarStatus, registrarFaturas, and other sensitive methods to disclose contribution and donation records or trigger financial workflow operations. A traversal-shaped nomeClasse value can also cause require_once to include an accessible PHP or configuration file outside the intended controller directory, exposing source code, credentials, or other sensitive local data. This issue is fixed in version 3.8.5.