CVE-2026-76633 in WeGIA
Summary
by MITRE • 08/20/2026
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in WeGIA versions prior to 3.9.2 represents a critical authorization bypass within the application's user authentication management subsystem, specifically targeting the password change functionality. This flaw stems from an improper implementation of access control mechanisms where the alterarSenha method is unconditionally excluded from standard permission checks located in controle/control.php. In secure web applications, any operation that modifies sensitive account data or credentials must undergo rigorous verification to ensure the requesting entity possesses valid authorization and has proven ownership of the current session. By omitting this specific method from the security filter chain, the application fails to enforce mandatory access controls, allowing authenticated users to execute privileged operations without satisfying the required preconditions for such actions.
The technical exploitation of this vulnerability relies on manipulating request parameters to alter the execution flow within the PHP backend logic. Specifically, an attacker can exploit the redir parameter, which is typically used to determine the post-operation redirect destination or internal routing path. By setting this parameter to point directly to alterar_senha.php, the application's control layer routes the request through verificarSenhaConfig() rather than the intended verification function, verificarSenha(). This diversion effectively bypasses the current password verification step that normally requires the user to input their existing credentials before proceeding with a password update. Consequently, the system accepts the new password submission without validating the authenticity of the requester against the existing account state, treating the request as if it had passed through standard authentication checks when it has not.
The operational impact of this vulnerability is severe, leading directly to permanent account takeover for any authenticated user who can exploit the flaw. Since the mechanism allows a user to change their own password without proving knowledge of the current one, an attacker with valid credentials but potentially compromised or weak existing passwords can instantly seize full control over the target account by setting a new, strong password known only to them. This undermines the fundamental security principle that authentication mechanisms must reliably verify identity before authorizing sensitive changes. Furthermore, because this bypass applies to any authenticated user, it facilitates lateral movement within an organization if multiple users are affected and credentials are leaked through other means, as attackers can easily hijack these accounts without needing to crack existing passwords or exploit additional vulnerabilities for initial access.
From a classification perspective, this vulnerability aligns with CWE-285, which describes Improper Authorization, specifically illustrating a failure in enforcing proper checks before allowing state-changing operations. It also relates closely to CWE-640, Weak Password Recovery Mechanism for Forgotten Password, as the flaw effectively allows password resets without sufficient proof of identity through existing credentials. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques involving account manipulation and credential access, where an adversary leverages application logic flaws to escalate privileges or maintain persistent access by securing control over user accounts. The lack of proper input validation on the redir parameter also touches upon CWE-20, Improper Input Validation, as the system fails to restrict the destination path to authorized internal routes only.
To mitigate this vulnerability, immediate remediation is required in the source code controlling the password change workflow. Developers must ensure that all methods responsible for modifying sensitive user data are included in the global permission check logic within controle/control.php or equivalent security middleware. The alterarSenha method should not be exempted from these checks unless there is a specific, well-documented architectural reason supported by alternative verification mechanisms. Additionally, the application should enforce strict validation on the redir parameter to prevent path traversal or unauthorized routing through internal endpoints like verificarSenhaConfig(). Implementing multi-factor authentication for password changes and ensuring that session tokens are tightly bound to the user's identity state can further reduce the risk of account takeover. Regular security audits focusing on authorization logic and input validation patterns are essential to identify similar flaws in other parts of the application before they can be exploited by malicious actors.