WeGIA SQLi: Authenticated Users Can Impersonate Others

The National Vulnerability Database has disclosed CVE-2026-40285, a high-severity SQL injection vulnerability (CVSS 8.8) in WeGIA, a web manager for charitable institutions. Versions prior to 3.6.10 are affected. The flaw resides in dao/memorando/UsuarioDAO.php and exploits an insecure handling of the cpf_usuario POST parameter.

This vulnerability allows any authenticated user to overwrite their session-stored identity via extract($_REQUEST) in DespachoControle::verificarDespacho(). The attacker-controlled value is then directly interpolated into a raw SQL query. This means a low-privileged user can execute database queries under the identity of any other arbitrary user, including administrators, leading to full data compromise and manipulation.

For defenders, this is a critical access control bypass. The fact that it requires authentication doesn’t diminish its severity; once an attacker has a foothold, even a low-level one, they can effectively escalate privileges and operate as any other user. Organizations using WeGIA must immediately upgrade to version 3.6.10 to remediate this issue and review logs for any suspicious activity indicative of unauthorized identity changes or database access.