Missing Authentication for Critical Function in WeGIA - #VU163007
Published: November 9, 2026
Vulnerability identifier: #VU163007
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to change medication statuses in WeGIA and corrupt healthcare workflow data.
The vulnerability exists due to continued execution after a login redirect in /WeGIA/html/saude/status_update.php when a request has no authenticated session. An unauthenticated remote attacker can submit a POST request with a known or guessed medication identifier and a chosen status to reach the database update without user interaction.
Affected software
WeGIA
Remediation
Install security update from vendor's website.
WeGIA - update to 3.9.3