CVE-2026-86274
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1 affecting the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java in the Authentication Flow component. Manipulation of the arguments cod/jwt leads to missing authorization. The attack may be launched remotely and the exploit is public. The project was informed but has not responded.
Risk Assessment
An attacker may bypass authorization mechanisms, potentially leading to unauthorized access to system functions and data.
Recommendation
Urgently apply patches or temporary mitigations such as additional JWT validation and access control. Monitor vendor response as well.
Other vulnerabilities in projeto-siga siga
See all- CVE-2026-86273High
A weakness has been identified in projeto-siga siga up to 11.1.1. The function DownloadExterno.getUrl in the HTML-to-PDF Endpoint component is affected. Manipulation of the html argument causes server-side request forgery, which can be initiated remotely. The exploit has been made public.
- CVE-2026-6990Low
A cross-site scripting vulnerability was found in projeto-siga siga version 11.0.3.18 in an unknown function of /sigawf/app/responsavel/novo. Manipulating the Nome/Descrição argument results in script injection. The attack can be initiated remotely and a public exploit is available.
Original NVD description (English source)
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS