rootpwn

critical · CVSS v3 9.1

CVE-2026-54767

WeGIA web manager for charitable institutions had an unauthenticated GET endpoint that could truncate critical tables. The flaw allowed atta

Overview

WeGIA web manager for charitable institutions had an unauthenticated GET endpoint that could truncate critical tables. The flaw allowed attackers to delete member and contributor data without authentication. It was fixed in version 3.8.5.

Description

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chave_correta value embedded in the public source repository. A remote attacker who obtains that value can reach the endpoint's TRUNCATE TABLE operations for the endereco, pessoafisica, pessoajuridica, and socio tables without an administrative session or application authorization, permanently destroying member and contributor records. The attack requires the affected tables to exist and the web process database account to possess truncation privileges. This issue is fixed in version 3.8.5.

Impact

Confidentiality: member data permanently lost. Integrity: database tables truncated, corrupting data. Availability: application cannot serve data. Defenders: administrators of WeGIA installations must patch or mitigate.

Remediation

Apply the 3.8.5 patch immediately. If patching is delayed, disable the deletar_socios.php endpoint or restrict access to authenticated users. Ensure the database account used by the web process has no TRUNCATE privileges and monitor logs for anomalous DELETE/ TRUNCATE activity.

Risk context

Critical severity with CVSS 9.1 indicates a high‑risk vulnerability that requires immediate attention. The lack of EPSS data does not reduce the urgency of patching.

Affected products

  • WeGIA web manager

Scores

Severity
critical
CVSS v2
9.4
CVSS v3
9.1
CVSS v4
—
EPSS
—

unauthenticated truncation database critical WeGIA web-manager patch

← All CVEs

Related CVEs

critical

CVE-2026-62874

CVE‑2026‑62874 exposes a flaw in Azure Billing where data authenticity is not properly verified. An attacker can exploit this to gain elevated privileges on the network, potentially accessing or modifying billing and subscription data. The vulnerability is critical with a CVSS v3 score of 10.0.

View analysis

critical

CVE-2026-69843

CVE‑2026‑69843 is a critical authentication bypass in Microsoft Fabric that lets an attacker spoof credentials and gain elevated privileges across the network. The flaw allows unauthorized users to impersonate legitimate accounts, potentially accessing sensitive data and services. It is a high‑risk vulnerability that requires immediate attention from defenders.

View analysis

critical

CVE-2026-85878

CVE-2026-85878 exposes an improper authorization flaw in Azure Database for PostgreSQL that lets an authenticated user gain elevated privileges across the network. The vulnerability can be exploited by users who already have access to the database, enabling them to perform actions beyond their intended scope. It is critical because it bypasses normal role boundaries and can lead to widespread compromise of data and services.

View analysis

critical

CVE-2026-93453

SOGo versions before 5.12.11 can construct password-reset links using a client-supplied Origin header as the link authority. This can cause valid recovery tokens to be delivered in links pointing to attacker-controlled domains. It matters because it can enable account takeover for users who rely on SOGo password recovery.

View analysis