WeGIA CVE-2026-76633

Exploitation requires an authenticated session in WeGIA at any privilege level - the vulnerability does not affect unauthenticated users. The attacker must be able to send an HTTP POST request to the password-change flow with the redir parameter set to alterar_senha.php. No special configuration, non-default feature, or elevated role is required beyond holding a valid session. The primary limiting factor is that initial authentication must be achieved first; however, this can be a low-privilege or temporary account. Exploitation is bounded to accounts the attacker holds a session for - lateral movement to other accounts is not directly possible through this flaw alone.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) scores 8.6, reflecting a realistic threat model: network-reachable, low complexity, requires only a low-privilege authenticated session, and yields full account control. The PR:L requirement is the primary limiting factor - an attacker must first obtain any valid session, whether through credential theft, phishing, or a separate vulnerability. There is no CISA KEV listing and no confirmed public exploit code, suggesting exploitation is not yet widespread. EPSS data was not provided. The combination of low attack complexity once authenticated, high impact (account takeover converts temporary access to permanent), and the straightforward parameter manipulation makes this a genuine priority for any WeGIA deployment - despite the niche product footprint. The CVSS score and technical description are consistent and non-conflicting; no signals suggest inflated scoring here.

An attacker with any valid WeGIA session - including a low-privilege user, a guest, or someone who obtained temporary session access through a separate means - crafts an HTTP request to the password-change endpoint, setting the redir parameter to alterar_senha.php. This routes the request through verificarSenhaConfig(), which skips current-password verification, allowing the attacker to set an arbitrary new password for the account and establish permanent control. No exploit code has been publicly identified, but the manipulation requires only crafting a single HTTP parameter, making it trivially reproducible by any developer who reads the advisory.