CVE-2026-54670

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.5

Description The contribution request dispatcher in the endpoint 'web/html/contribuicao/controller/control.php' accepts attacker-controlled nomeClasse and metodo values without a complete allowlist. This allows unauthenticated remote attackers to bypass authentication for sensitive ContribuicaoLogController operations, enabling the invocation of methods such as getContribuicoesLogJSON(), sincronizarStatus(), and registrarFaturas() to disclose donation records or trigger financial workflows. Additionally, the software constructs include paths without canonical directory containment, allowing a traversal-shaped nomeClasse value to force require once to include PHP or configuration files outside the intended directory, potentially exposing source code and credentials.

Recommendations Update to version 3.8.5.