What is the CVSS score of CVE-2026-40285?

CVE-2026-40285 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-40285?

WeGIA charitable institution manager versions before 3.6.10 contain a SQL injection vulnerability in user identity handling that allows any authenticated employee or volunteer to impersonate other…. A patch is available.

How to fix or mitigate CVE-2026-40285?

Within 24 hours: Inventory all WeGIA deployments and confirm versions in use; restrict database access permissions to the application service account (principle of least privilege) and disable any unused user accounts. Within 7 days: Contact WeGIA vendor for patch availability timeline and request emergency security update; if patch is released, apply version 3.6.10 or later to all instances. Within 30 days: Complete patching of all systems; conduct database audit logs for unauthorized access attempts using the cpf_usuario parameter; review user access logs for anomalous impersonation activity.

PHP CVE-2026-40285

EUVD-2026-23529 HIGH

SQL Injection (CWE-89)

2026-04-17 GitHub_M

PHP SQLi

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 20, 2026 - 19:02 nvd

Patch available

Re-analysis Queued

Apr 17, 2026 - 21:22 vuln.today

cvss_changed

Patch available

Apr 17, 2026 - 21:16 EUVD

Analysis Generated

Apr 17, 2026 - 21:11 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 20:45 euvd

EUVD-2026-23529

Analysis Generated

Apr 17, 2026 - 20:45 vuln.today

CVE Published

Apr 17, 2026 - 20:25 nvd

HIGH 8.8

DescriptionGitHub Advisory

WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usuario POST parameter overwrites the session-stored user identity via extract($_REQUEST) in DespachoControle::verificarDespacho(), and the attacker-controlled value is then interpolated directly into a raw SQL query, allowing any authenticated user to query the database under an arbitrary identity. Version 3.6.10 fixes the issue.

AnalysisAI

SQL injection in WeGIA charitable institution manager allows authenticated users to impersonate arbitrary identities and execute database queries with elevated privileges. The cpf_usuario parameter in dao/memorando/UsuarioDAO.php bypasses session-based identity controls through PHP's extract($_REQUEST) function, enabling any low-privileged authenticated user to query sensitive data or modify database contents as any other user, including administrators. WeGIA versions before 3.6.10 are affected. No public exploit identified at time of analysis, though exploitation complexity is low (CVSS AC:L) requiring only valid user credentials.

Technical ContextAI

WeGIA is a PHP-based web application designed for managing charitable institutions. This vulnerability exploits PHP's extract() function, which creates variables from array keys - in this case, from the global $_REQUEST superglobal containing both GET and POST parameters. The affected code path is in DespachoControle::verificarDespacho() which calls extract($_REQUEST), allowing POST parameter 'cpf_usuario' to overwrite legitimate session-stored user identity variables. This attacker-controlled value is then directly concatenated into raw SQL queries in dao/memorando/UsuarioDAO.php without parameterization or input validation, constituting a classic CWE-89 SQL injection vulnerability. The dual nature of this flaw combines variable overwriting with SQL injection, making it particularly dangerous as it bypasses application-layer identity controls before the database query is even constructed.

RemediationAI

Upgrade WeGIA to version 3.6.10 or later, which contains the vendor-released patch addressing both the unsafe extract($_REQUEST) usage and SQL injection vulnerability. The fix can be obtained from the official GitHub repository at https://github.com/LabRedesCefetRJ/WeGIA. If immediate patching is not feasible, implement the following compensating controls with noted limitations: (1) Disable or restrict access to the memorando/despacho functionality at the web server level (e.g., via .htaccess or nginx location blocks) - this prevents exploitation but breaks legitimate memo dispatch features used by administrators; (2) Implement Web Application Firewall rules to block POST requests containing 'cpf_usuario' parameter to affected endpoints - this may cause false positives if the parameter is legitimately used elsewhere in the application; (3) Restrict application access to only trusted IP ranges via firewall rules - this reduces attack surface but doesn't address insider threats from authenticated users on trusted networks. None of these workarounds fully mitigate the vulnerability; upgrading to 3.6.10 is the only complete remediation. Review application logs for suspicious cpf_usuario parameter usage or anomalous database queries under unexpected user contexts as potential indicators of prior exploitation.