Improper Restriction of Rendered UI Layers or Frames in WeGIA - CVE-2026-23731
Published: April 23, 2026
Vulnerability identifier: #VU127305
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-23731
CWE-ID: CWE-1021
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform ui redressing attacks and trigger unauthorized actions.
The vulnerability exists due to improper restriction of rendered ui layers or frames in the web application when handling framed page loads. A remote attacker can embed the application in a malicious page and trick a user into clicking disguised elements to perform ui redressing attacks and trigger unauthorized actions.
User interaction is required, and exploitation relies on the victim having an active session.
Affected software
WeGIA
How to mitigate CVE-2026-23731
Install security update from vendor's website.
WeGIA - update to 3.6.2