Open Redirect Flaw in WeGIA Web Manager for Charitable Institutions

CVE-2026-23727

What is CVE-2026-23727?

The WeGIA web manager for charitable institutions has an Open Redirect vulnerability in the /WeGIA/controle/control.php endpoint. Specifically, the issue arises from improper validation of the nextPage parameter when used alongside metodo=listarTodos and nomeClasse=TipoSaidaControle. This security weakness allows malicious actors to redirect users to arbitrary external sites, thereby facilitating phishing attacks, credential theft, and malware distribution, all while appearing legitimate through the trusted WeGIA domain. This vulnerability has been addressed in version 3.6.2.

References