SB2026111330 - Multiple vulnerabilities in WeGIA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111330

SB2026111330 - Multiple vulnerabilities in WeGIA

Published: November 13, 2026

Security Bulletin ID SB2026111330
CSH Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 25% Medium 63% Low 13%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to overwrite donors' personal information, recurring donation amounts, and tag associations without authorization.

The vulnerability exists due to missing authorization in WeGIA's SocioController::atualizarSocio when the publicly accessible route processes donor updates keyed solely by CPF without verifying record ownership. A remote attacker can solve one reCAPTCHA and submit a POST request containing a target donor's CPF in documento_socio and replacement field values to modify that donor's records.


2) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose complete donor personal information and determine whether a CPF belongs to any registered person.

The vulnerability exists due to missing authorization in WeGIA's SocioController::buscarPorDocumento route when handling public donor lookups, because its whitelist entry bypasses session and permission checks. A remote attacker can send GET requests with known or guessed CPF values in the documento parameter to retrieve donor identities, contact details, addresses, and tags, or inspect pessoaExists responses to identify registered people, including staff and residents.


3) Sensitive Cookie Without 'HttpOnly' Flag (CVE-ID: N/A)

CWE-ID: CWE-1004 - Sensitive Cookie Without 'HttpOnly' Flag

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to steal authentication session identifiers and potentially impersonate authenticated users.

The vulnerability exists due to omission of the HttpOnly attribute in WeGIA's PHP session cookie configuration when issuing PHPSESSID cookies. A remote attacker can leverage JavaScript execution in the application's origin, for example through cross-site scripting, to read PHPSESSID through document.cookie and potentially reuse the identifier to impersonate the associated user while the session remains valid.


4) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose application configuration data, internal endpoint routes, and hardcoded Brazilian national ID numbers without authentication.

The vulnerability exists due to missing authentication enforcement in WeGIA's html/atendido/Cadastro_Atendido.php when failed session or permission checks issue redirects without terminating script execution. A remote attacker can send a GET request without a session cookie and inspect the redirect response body to retrieve the complete registration page, including atendido_tipo and atendido_status table contents.


5) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read restricted occurrence attachments in WeGIA across role boundaries.

The vulnerability exists due to incorrect authorization in html/atendido/exibe_anexo.php when serving attachments without checking resource permissions or document ownership. A remote user can submit requests with guessed or enumerated occurrence and document identifiers to download restricted files.


6) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose the organization's full billing ledger, including payer names, charge codes, payment dates, amounts, and payment status.

The vulnerability exists due to missing authentication in WeGIA's html/socio/sistema/processa_cobrancas_tabela.php endpoint when handling billing requests. A remote attacker can send a GET or POST request without a session cookie to retrieve every charge as JSON.


7) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose the complete WeGIA member registry, including names, email addresses, phone numbers, addresses, CPF/CNPJ identifiers, and member types.

The vulnerability exists due to missing authentication in html/socio/sistema/controller/import_conteudo_graficos.php when handling requests that query and display all member records without session or permission checks. A remote attacker can send GET /html/socio/sistema/controller/import_conteudo_graficos.php without a session cookie to retrieve sensitive member information in an HTML table.


8) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to steal the live BoletoFacil API token, create charges, and access payer information on behalf of the organization.

The vulnerability exists due to missing authentication in WeGIA's import_conteudo_processacontribuicao.php when handling requests to a page that embeds the provider token in inline JavaScript. A remote attacker can request the page without a session, extract token_api from the response, and use it to make unauthorized BoletoFacil API calls.


Remediation

Install update from vendor's website.

References