Description

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-20T14:17:59.680Z",
  "pubdate": "2026-08-20T14:17:59.680Z",
  "executiveSummary": "An authorization bypass vulnerability exists in WeGIA before 3.9.2 within the password change flow, allowing authenticated users to modify their account passwords without providing existing credentials. This flaw impacts the WeGIA application by enabling attackers to achieve full account takeover.\nThe risk implication is severe, as any authenticated user can exploit the vulnerability to escalate control over accounts, potentially leading to unauthorized access to sensitive administrative functions and data stored within the platform.\nAttacker capabilities require authenticated access to the system. By leveraging the flaw, an attacker can convert temporary session access into permanent account takeover without needing knowledge of the victim's current password.",
  "technicalDetails": "The root cause of the vulnerability stems from the unconditional exclusion of the alterarSenha method from permission checks within controle/control.php.\nThe vulnerable component is the password change mechanism handled by controle/control.php and routed through alterar_senha.php.\nAffected versions include all WeGIA installations prior to version 3.9.2. The vulnerability requires authentication, but no special privileges beyond a standard authenticated user session, and is exploitable over network exposures where the application is hosted.\nThe attack flow proceeds as follows: First, an attacker manipulates the redir parameter to route requests to alterar_senha.php. This manipulation causes the application to invoke verificarSenhaConfig() instead of the standard verificarSenha() validation function.\nBecause the alterarSenha method is unconditionally excluded from permission checks in controle/control.php, the application bypasses the requirement to verify the user's existing credentials.\nAs a result of this payload behavior, the application accepts the new password submission without validation of the old password, successfully converting temporary session access into permanent account takeover."
}