CVE-2026-54670: WeGIA: Unauthenticated Auth Bypass + Local File Inclusion
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive ContribuicaoLogController operations from authentication, and constructs a controller include path without canonical directory containment. An unauthenticated remote attacker can invoke getContribuicoesLogJSON, sincronizarStatus, registrarFaturas, and other sensitive methods to disclose contribution and donation records or trigger financial workflow operations. A traversal-shaped nomeClasse value can also cause requireonce to include an accessible PHP or configuration file outside the intended controller directory, exposing source code, credentials, or other sensitive local data. This issue is fixed in version 3.8.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.8.5
Event History
Frequently Asked Questions
Which deployments are affected?
WeGIA deployments running versions before 3.8.5 are affected. The issue is reachable remotely without authentication through the contribution request dispatcher.
What can an unauthenticated attacker do?
An attacker can call sensitive contribution-related methods, including getContribuicoesLogJSON, sincronizarStatus, and registrarFaturas, to disclose contribution or donation records or trigger financial workflow operations. They may also use a traversal-shaped nomeClasse value to include accessible PHP or configuration files outside the intended controller directory.
What is required for exploitation?
No credentials or user interaction are required, and the attack complexity is low. Exploitation requires network access to the affected WeGIA web application.
What should be done if patching cannot happen immediately?
The provided data identifies version 3.8.5 as the fix. It does not provide a documented workaround or compensating control for unpatched deployments.