Incorrect authorization in WeGIA - #VU163010
Published: November 9, 2026
Vulnerability identifier: #VU163010
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated employee to download the full WeGIA database or overwrite it with an uploaded dump.
The vulnerability exists due to WeGIA's permissao() authorization gate comparing permission bitmasks as numeric ranks and accepting explicit denial values when the default permission requirement is used. An authenticated employee can directly request protected endpoints when their role has an existing permission row marked SEM ACESSO or otherwise lacking the required permission bits.
Affected software
WeGIA
Remediation
Install security update from vendor's website.
WeGIA - update to 3.9.4