Incorrect authorization in WeGIA - #VU163011
Published: November 9, 2026
Vulnerability identifier: #VU163011
CSH Severity: Medium
CVSS v4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated contributions operator to capture donors' raw payment card data and the payment provider API key in WeGIA.
The vulnerability exists due to the gateway update controller checking contributions permissions instead of gateway management permissions. An authenticated contributions operator with action level 3 or higher can use their own CSRF token to redirect an active gateway to an attacker-controlled endpoint, exposing payment data when a donor subsequently pays.
Affected software
WeGIA
Remediation
Install security update from vendor's website.
WeGIA - update to 3.9.4