SB2026070746 - Multiple vulnerabilities in WeGIA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026070746

SB2026070746 - Multiple vulnerabilities in WeGIA

Published: July 7, 2026

Security Bulletin ID SB2026070746
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 67% Medium 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-54671)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access, modify, and delete arbitrary interno records and disclose sensitive information.

The vulnerability exists due to missing authorization in InternoControle and the permission check in MiddlewareDAO when handling POST requests to /controle/control.php with nomeClasse=InternoControle and user-controlled id parameters. A remote user can send a specially crafted request to access, modify, and delete arbitrary interno records and disclose sensitive information.

The issue affects all methods in InternoControle because an empty resource array causes unconditional access, and no ownership verification is performed on the referenced records.


2) Path traversal (CVE-ID: CVE-2026-54670)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in web/html/contribuicao/controller/control.php when processing the nomeClasse parameter in POST requests to /html/contribuicao/controller/control.php. A remote attacker can supply a crafted controller path to disclose sensitive information.

The issue can be exploited without authentication, and included files may expose configuration data and PHP source files.


3) Use of hard-coded credentials (CVE-ID: CVE-2026-54767)

CWE-ID: CWE-798 - Use of Hard-coded Credentials

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause mass data destruction.

The vulnerability exists due to use of hard-coded credentials and missing authentication for a critical function in the deletar_socios.php endpoint when handling a crafted GET request with the chave parameter. A remote attacker can supply the exposed secret key to trigger deletion of database records and tables to cause mass data destruction.

The secret key is publicly visible in the source repository.


Remediation

Install update from vendor's website.

References