CVE-2026-54767

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.5

Description An unauthenticated GET endpoint at 'web/html/socio/sistema/controller/deletar socios.php' validates the chave parameter against a hardcoded chave correta value found in the public source repository. A remote attacker possessing this value can bypass administrative sessions and application authorization to execute TRUNCATE TABLE operations—which permanently remove all rows from a table—on the endereco, pessoafisica, pessoajuridica, and socio tables. This action results in the permanent destruction of member and contributor records, provided the tables exist and the database account used by the web process has truncation privileges.

Recommendations Update to version 3.8.5. Restrict access to the 'web/html/socio/sistema/controller/deletar socios.php' endpoint as a temporary mitigation.