CVE-2026-76633
HighCVSS 8.1Summary
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.
Risk Assessment
An authenticated user can take over another user's account, which can lead to unauthorized access to data and system functions, and consequently to confidentiality and integrity breaches.
Recommendation
It is recommended to immediately upgrade WeGIA to version 3.9.2 or later, which includes fixes. Also, review access logs for suspicious password changes and consider enforcing stronger authentication.
Other vulnerabilities in WeGIA
See all- CVE-2026-76634Medium
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all user identifiers to retrieve full profile data for any employee account, including name, CPF, address, contact details, and administrative flags.
- CVE-2026-23723High
WeGIA is a web manager for charitable institutions. Prior to version 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaControle endpoint via the id_memorando parameter. This flaw allows for full database exfiltration, exposure of sensitive PII, and potential arbitrary file reads in misconfigured environments. This vulnerability is fixed in 3.6.2.
- CVE-2026-23722Critical
WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WeGIA system, specifically within the html/memorando/insere_despacho.php file. The application fails to properly sanitize or encode user-supplied input via the id_memorando GET parameter before reflecting it into the HTML source (likely inside a <script> block or an attribute). This allows unauthenticated attackers to inject arbitrary JavaScript or HTML into the context of the user's browser session. This vulnerability is fixed in 3.6.2.
- CVE-2026-35475Medium
WeGIA prior to version 3.6.9 contains an open redirect vulnerability. The 'redirect' parameter taken from the GET request is not validated or whitelisted, then used directly in a Location header. An attacker can redirect users to a malicious site.
- CVE-2026-35474Medium
WeGIA before version 3.6.9 contains an open redirect vulnerability. The 'redirect' parameter is taken directly from $_GET without URL validation and used in a Location header, allowing redirection to arbitrary external sites.
- CVE-2026-35473Medium
WeGIA before version 3.6.9 has an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the 'nextPage' parameter. The application fails to validate this parameter, allowing attackers to redirect users to arbitrary external sites.
- CVE-2026-35472Medium
WeGIA before version 3.6.9 contains an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle. The parameter is not validated, allowing redirection to arbitrary external websites.
- CVE-2026-35399Medium
WeGIA before 3.6.9 has a stored XSS vulnerability via a backup filename. An attacker can inject malicious scripts that execute in the victim's browser.
- CVE-2026-35398Medium
WeGIA prior to 3.6.9 has an Open Redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter. The application fails to validate the parameter, allowing redirection to arbitrary external sites.
- CVE-2026-35396Medium
WeGIA before version 3.6.9 contains an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter when combined with metodo=listarId and nomeClasse=IsaidaControle. The parameter is not validated, allowing redirection to arbitrary external websites.
Original NVD description (English source)
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.