Missing Authentication for Critical Function in WeGIA - #VU163005
Published: November 9, 2026
Vulnerability identifier: #VU163005
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to create arbitrary remittance records in WeGIA, compromising the integrity of banking and contribution data.
The vulnerability exists due to missing authentication in /WeGIA/html/socio/sistema/cadastro_remessas_geracao.php when processing requests to create remittances. An unauthenticated remote attacker can submit a POST request without a session cookie to persist attacker-controlled remittance data, as demonstrated with zero-value records containing no slips or associated member.
Affected software
WeGIA
Remediation
Install security update from vendor's website.
WeGIA - update to 3.9.3