WeGIA CVE-2026-45027

Exploitation requires prior access to the WeGIA password hash database - obtained through a separate attack such as SQL injection, database backup exposure, server-level file read, or insider access. The CVSS AC:H designation directly encodes this prerequisite. Without the hash data, the unsalted hashing weakness cannot be exploited remotely in isolation. All WeGIA deployments running versions prior to 3.7.3 are affected regardless of configuration, as the insecure hashing is hardcoded in the authentication and password-change source files rather than controlled by a configuration option. Exploitation is not limited by authentication (PR:N) once hashes are obtained, and requires no user interaction (UI:N). The primary limiting factor is the requirement to first exfiltrate the hash database through a separate vulnerability or access path.

The CVSS 5.9 (Medium) score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N accurately captures a nuanced risk profile: the high attack complexity (AC:H) reflects the prerequisite that the attacker must first obtain the hash database through a separate compromise vector (SQL injection, backup theft, server breach), meaning this is not a standalone remote exploit. Confidentiality impact is rated High because once hashes are retrieved, plaintext recovery is practically guaranteed for any password appearing in common rainbow tables. Integrity and availability are unaffected by this specific flaw. No EPSS score was provided in the input data, limiting probabilistic exploitation forecasting. No CISA KEV listing exists and no public POC has been identified, suggesting no confirmed active exploitation at time of analysis. The real-world priority is moderate: organizations running WeGIA should patch promptly given the severity of credential exposure upon any database leak, but this does not represent a standalone critical remote code execution risk.

An attacker who has obtained the WeGIA user database - for example via a SQL injection vulnerability or a misconfigured database backup - loads the SHA-256 password column into a rainbow table tool such as hashcat with a precomputed SHA-256 table. Because no salt differentiates identical passwords, every account using a password present in the table is cracked in a single lookup pass, potentially exposing all user credentials simultaneously. No public exploit code was identified at time of analysis, but the attack is well within reach of any attacker with database access and consumer-grade GPU hardware.