Vulnerability · Published Feb 27, 2026 · Assigned by GitHub_M
CVE-2026-28411WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)`
Critical 9.8
In plain English
A critical-severity authentication bypass in WeGIA from LabRedesCefetRJ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.7% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts. This vulnerability can be leveraged to completely bypass authentication checks, allowing unauthorized access to administrative and protected areas of the WeGIA application. Version 3.6.5 fixes the issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LabRedesCefetRJ | WeGIA | < 3.6.5 |
Weakness: CWE-288, CWE-473 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g7r9-hxc8-8vh7 x_refsource_CONFIRM