WeGIA CVE-2026-54767

No authentication or user interaction required: deletar_socios.php is an unauthenticated GET endpoint whose only gate is a sha256 match against the hardcoded chave_correta string, which is committed in the public WeGIA source repository and therefore known to any attacker. Concrete prerequisites limiting exploitation are: (1) the target must run WeGIA prior to version 3.8.5 (the fix deletes the file entirely); (2) the endereco, pessoafisica, pessoajuridica, and socio tables must exist; and (3) the web process's database account must hold TRUNCATE privileges. There is no non-default configuration or admin session needed - exposure is inherent to any vulnerable deployment reachable over the network.

This is a genuinely high-severity, low-friction data-destruction flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, 9.1) is well-supported: the endpoint is a plain unauthenticated GET, and the only gate is a sha256 comparison against a hardcoded chave_correta string that is committed in the PUBLIC WeGIA source repository - so the 'secret' provides no meaningful barrier and PR:N is correct. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active exploitation; per precision rules this is 'no public exploit identified at time of analysis.' However, the supplied commit diff plus the plaintext key effectively constitute an exploitation recipe, lowering the barrier to weaponization considerably. Impact is destroy-only: C:N (no data is read/exfiltrated), I:H and A:H (TRUNCATE permanently wipes the endereco, pessoafisica, pessoajuridica, and socio tables). The main thing tempering real-world risk is deployment footprint - WeGIA is an obscure academic open-source project - not the technical severity, which is real for any organization actually running it.

An attacker reads the hardcoded chave_correta value ('h)8^#w4T<HaN-GSc&BM3[<?mvG[R?b') directly from the public LabRedesCefetRJ/WeGIA GitHub repository, then sends a single unauthenticated GET request to deletar_socios.php with ?chave=<that value>. The sha256 comparison passes and the endpoint runs TRUNCATE TABLE against the member and contributor tables, permanently destroying all records. No POC is published, but the commit diff and the embedded secret make the attack trivially reproducible.