Vulnerability · Published Aug 20, 2026 · Assigned by VulnCheck

CVE-2026-76633WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha

High 8.1

In plain English

A high-severity missing authorization in WeGIA from LabRedesCefetRJ. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.4%top 61.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.

Affected products (as reported)

Vendor	Product	Versions
LabRedesCefetRJ	WeGIA	0 – before 3.9.2

Weakness: CWE-862, CWE-620 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-gfcx-7973-hjmp) vendor-advisory
Release Notes release-notes
https://www.vulncheck.com/advisories/wegia-authorization-bypass-password-change-via-alterarsenha third-party-advisory