SB20261109172 - Multiple vulnerabilities in WeGIA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109172

SB20261109172 - Multiple vulnerabilities in WeGIA

Published: November 9, 2026

Security Bulletin ID SB20261109172
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 75% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) PHP External Variable Modification (CVE-ID: N/A)

CWE-ID: CWE-473 - PHP External Variable Modification

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged attacker to disclose server files readable by WeGIA's PHP worker.

The vulnerability exists due to request parameters overwriting upload metadata in web/html/atendido/docfamiliar_upload.php, causing an attacker-supplied path to be read without verifying that it represents an uploaded file. A low-privileged attacker can submit a crafted POST request and retrieve the stored contents through the document viewer when granted resource 11 access, provided database settings permit the document insertion with explicit_defaults_for_timestamp disabled.


2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated employee to download the full WeGIA database or overwrite it with an uploaded dump.

The vulnerability exists due to WeGIA's permissao() authorization gate comparing permission bitmasks as numeric ranks and accepting explicit denial values when the default permission requirement is used. An authenticated employee can directly request protected endpoints when their role has an existing permission row marked SEM ACESSO or otherwise lacking the required permission bits.


3) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated contributions operator to capture donors' raw payment card data and the payment provider API key in WeGIA.

The vulnerability exists due to the gateway update controller checking contributions permissions instead of gateway management permissions. An authenticated contributions operator with action level 3 or higher can use their own CSRF token to redirect an active gateway to an attacker-controlled endpoint, exposing payment data when a donor subsequently pays.


4) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript in the WeGIA application origin within an authenticated victim's browser.

The vulnerability exists due to unsafe request variable extraction in web/html/sucesso.php, allowing request parameters to overwrite session values rendered without HTML encoding. An unauthenticated remote attacker can send a crafted link to a victim with an active authenticated session, causing reflected cross-site scripting when the victim clicks it.


Remediation

Install update from vendor's website.

References