SB20261109170 - Multiple vulnerabilities in WeGIA

Description

This security bulletin contains information about 2 vulnerabilities.

1) Unverified Password Change (CVE-ID: CVE-2026-76633)

CWE-ID: CWE-620 - Unverified Password Change

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a low-privileged attacker with temporary access to a victim's authenticated session to take over that account by changing its password.

The vulnerability exists due to missing current-password verification in WeGIA's password change flow when the redir parameter selects alterar_senha.php, while the operation bypasses permission checks. A low-privileged attacker can submit a new password with a valid session CSRF token and subsequently log in without knowing the victim's original password.

2) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-76634)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated attacker to read other employees' full profiles in WeGIA, exposing sensitive personal information without authorization.

The vulnerability exists due to request parameter extraction in html/funcionario/profile_funcionario.php overwriting the session-derived employee identifier when an id_pessoa query parameter is supplied. An authenticated attacker can submit requests with successive identifier values to enumerate employee profiles and retrieve personal data, including tax identifiers, addresses, and contact details.

Remediation

Install update from vendor's website.

References

• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-gfcx-7973-hjmp
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jqh5-66qr-85qv