CVE-2026-76633: WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterarsenha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.9.2 - Compensating control
Restrict access to the password change functionality (alterar_senha) to only users who have passed existing-password verification, until WeGIA is upgraded to 3.9.2.
Event History
Frequently Asked Questions
Which installations are affected?
WeGIA versions earlier than 3.9.2 are affected. Any deployment where a user can obtain an authenticated session is exposed to this password-change bypass.
What does an attacker need to exploit this issue?
The attacker needs an authenticated session but does not need to know the account's current password. They can manipulate the redir parameter to route the password-change flow through verificarSenhaConfig() rather than verificarSenha().
How can I determine whether my deployment is vulnerable?
Check the installed WeGIA version: versions before 3.9.2 are affected. The vulnerable behavior involves controle/control.php excluding the alterarSenha method from permission checks and allowing redirection to alterar_senha.php.
What is the available remediation?
Upgrade WeGIA to version 3.9.2 or later. The issue is reported as affecting versions before 3.9.2.