Authorization Bypass in WeGIA Allows Unauthorized Password Changes

CVE-2026-76633

What is CVE-2026-76633?

WeGIA, prior to version 3.9.2, has an authorization bypass vulnerability in its password change flow, which allows any authenticated user to change their account password without verifying existing credentials. This issue arises from the unconditional exclusion of the ''alterarSenha'' method from permission checks located in ''controle/control.php''. Attackers can exploit this vulnerability by manipulating the ''redir'' parameter to redirect to ''alterar_senha.php'', circumventing current password verification mechanisms. This may lead to unauthorized permanent account access, effectively converting temporary session privileges into complete account takeover.

References