Session Hijacking Vulnerability in WeGIA Web Manager by LabRedesCefetRJ
CVE-2026-55682

8.1HIGH

Key Information:

Vendor

Labredescefetrj

Status
Wegia
Vendor
CVE Published:
14 October 2026

What is CVE-2026-55682?

WeGIA, a web management tool for charitable organizations, contains a vulnerability whereby an attacker can exploit PHP sessions. Prior to version 3.8.6, the application fails to secure the PHPSESSID cookie, allowing an attacker to gain unauthorized access by using their chosen session identifier. Additionally, this vulnerability exposes sensitive information, such as the internal database host name, within the cookie domain attribute. Users who authenticate while this exploit is ongoing are susceptible to session hijacking, compromising their security. Version 3.8.6 addresses this issue and ensures proper session handling.

Affected Version(s)

WeGIA < 3.8.6

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisor...
x_refsource_CONFIRM
https://github.com/LabRedesCefetRJ/WeGIA/issues/221
x_refsource_MISC
https://github.com/LabRedesCefetRJ/WeGIA/pull/1705
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.