CVE-2026-28411: WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)`
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the extract() function on the $REQUEST superglobal allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts. This vulnerability can be leveraged to completely bypass authentication checks, allowing unauthorized access to administrative and protected areas of the WeGIA application. Version 3.6.5 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28411?
CVE-2026-28411 is considered a high severity vulnerability due to its potential for authentication bypass.
How do I fix CVE-2026-28411?
To fix CVE-2026-28411, upgrade WeGIA to version 3.6.5 or later.
What is the impact of CVE-2026-28411?
The impact of CVE-2026-28411 allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts.
Which versions of WeGIA are affected by CVE-2026-28411?
WeGIA versions prior to 3.6.5 are affected by CVE-2026-28411.
Is CVE-2026-28411 exploitable remotely?
Yes, CVE-2026-28411 is exploitable remotely since it relies on the `extract($_REQUEST)` function.