What is the CVSS score of CVE-2026-45027?

CVE-2026-45027 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45027?

Yes, a patch is available for CVE-2026-45027. Update the affected software to the latest version immediately.

WeGIA CVE-2026-45027

EUVD-2026-32565 MEDIUM

Use of a One-Way Hash without a Salt (CWE-759)

2026-05-27 security-advisories@github.com

PHP Information Disclosure

5.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 21:08 vuln.today

Patch available

May 27, 2026 - 19:46 EUVD

DescriptionGitHub Advisory

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, when a user logs in, html/login.php hashes the submitted password using PHP's hash() function with the SHA-256 algorithm and no salt before comparing it to the stored value. The password change flow in controle/FuncionarioControle.php follows the same pattern. SHA-256 is a general-purpose cryptographic hash built for speed, not password storage. Without a salt, identical passwords produce identical digests, making the entire hash database vulnerable to a single precomputed rainbow table lookup. This vulnerability is fixed in 3.7.3.

AnalysisAI

Unsalted SHA-256 password hashing in WeGIA exposes all stored credentials to rainbow table attacks in versions prior to 3.7.3. Both the login flow (html/login.php) and the password-change flow (controle/FuncionarioControle.php) use PHP's hash() with SHA-256 and no per-user salt, meaning identical passwords always produce identical digests and a single precomputed table can compromise the entire credential database at once. No public exploit has been identified at time of analysis and no KEV listing exists, but exploitability is high once hash data is obtained - the attack requires only standard rainbow table tooling and no cryptographic skill.

Technical ContextAI

WeGIA is a PHP-based web management platform for charitable institutions. CWE-759 (Use of a One-Way Hash without a Salt) describes the root cause precisely: the application calls PHP's generic hash('sha256', $password) rather than the purpose-built password_hash() function, which defaults to bcrypt and automatically generates a cryptographically random per-user salt. SHA-256 is optimized for speed - it can be computed billions of times per second on commodity GPUs - making it entirely unsuitable for password storage. Without a salt, two users sharing the same password share the same digest, and an attacker can precompute a lookup table mapping common SHA-256 digests back to plaintext once and apply it to every account in the database simultaneously. No CPE strings were provided in the source data; affected versions are identified as WeGIA < 3.7.3 per EUVD-2026-32565.

RemediationAI

The vendor-released patch is WeGIA 3.7.3, which resolves the unsalted hashing in both html/login.php and controle/FuncionarioControle.php. Upgrade instructions and the full advisory are available at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-hcgv-vmq6-j6qg. After upgrading, administrators should force a global password reset so that all existing unsalted SHA-256 digests stored in the database are invalidated and replaced with properly salted hashes under the new scheme - failing to do so leaves previously stored hashes exploitable if the database was ever exfiltrated. If immediate upgrade is not possible, restrict database access to application-layer processes only, disable external database exposure, and audit access logs for unauthorized database queries as a compensating control. Note that these controls reduce the attack surface for hash extraction but do not fix the underlying cryptographic weakness.