CVE-2026-76633

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/LabRedesCefetRJ/WeGIA/releases#release-3.9.2
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-gfcx-7973-hjmp
https://www.vulncheck.com/advisories/wegia-authorization-bypass-password-change-via-alterarsenha

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) WeGIA anterior a 3.9.2 contiene una vulnerabilidad de omisión de autorización en el flujo de cambio de contraseña que permite a cualquier usuario autenticado cambiar la contraseña de su cuenta sin proporcionar las credenciales existentes, explotando la exclusión incondicional del método alterarSenha de las comprobaciones de permisos en controle/control.php. Los atacantes pueden manipular el parámetro redir para que apunte a alterar_senha.php, enrutando a través de verificarSenhaConfig() en lugar de verificarSenha() para omitir la verificación de la contraseña actual y convertir el acceso temporal a la sesión en una toma de control permanente de la cuenta.

Information

Published : 2026-08-20 14:17

Updated : 2026-10-18 20:10

NVD link : CVE-2026-76633

Mitre link : CVE-2026-76633

CVE.ORG link : CVE-2026-76633

JSON object : View

Products Affected

No product.

CWE

CWE-620

Unverified Password Change

CWE-862

Missing Authorization

{"id": "CVE-2026-76633", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76633", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T13:53:06.320385Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/LabRedesCefetRJ/WeGIA", "vendor": "LabRedesCefetRJ", "product": "WeGIA", "versions": [{"status": "affected", "version": "0", "lessThan": "3.9.2", "versionType": "semver"}], "packageURL": "pkg:github/LabRedesCefetRJ/WeGIA", "defaultStatus": "affected"}]}], "published": "2026-08-20T14:17:59.680", "references": [{"url": "https://github.com/LabRedesCefetRJ/WeGIA/releases#release-3.9.2", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-gfcx-7973-hjmp", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/wegia-authorization-bypass-password-change-via-alterarsenha", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-620"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover."}, {"lang": "es", "value": "WeGIA anterior a 3.9.2 contiene una vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n en el flujo de cambio de contrase\u00f1a que permite a cualquier usuario autenticado cambiar la contrase\u00f1a de su cuenta sin proporcionar las credenciales existentes, explotando la exclusi\u00f3n incondicional del m\u00e9todo alterarSenha de las comprobaciones de permisos en controle/control.php. Los atacantes pueden manipular el par\u00e1metro redir para que apunte a alterar_senha.php, enrutando a trav\u00e9s de verificarSenhaConfig() en lugar de verificarSenha() para omitir la verificaci\u00f3n de la contrase\u00f1a actual y convertir el acceso temporal a la sesi\u00f3n en una toma de control permanente de la cuenta."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "disclosure@vulncheck.com"}