PT-2026-22411 · Wegia · Wegia

Gabrielpintosouza

·

Published

2026-02-27

·

Updated

2026-03-04

·

CVE-2026-28408

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.6.5
Description WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the adicionar tipo docs atendido.php script does not utilize the project’s central controller and lacks appropriate authentication and permission checks. This allows a malicious user to access features intended for employees by making requests through tools like Postman or directly via the file’s URL. The issue enables external parties to inject unauthorized data into the application server’s storage. The adicionar tipo docs atendido.php script is directly accessible, bypassing normal security measures.
Recommendations Versions prior to 3.6.5: Update to version 3.6.5 or later to resolve the authentication bypass and data injection issue.

Exploit

Fix

Improper Authentication

Missing Authorization

Weakness Enumeration

CWE-287CWE-862

Related Identifiers

CVE-2026-28408
GHSA-XQ3W-XWXJ-FG2Q

Affected Products

Wegia