CVE-2025-53938

WeGIA vulnerable to Authentication Bypass due to Missing Session Validation in multiple endpoints

State: Published
Severity: 6.9 Medium
Published: Jul 16, 2025
Updated: Jul 18, 2025
Reserved: Jul 14, 2025

Description

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Authentication Bypass vulnerability was identified in the `/dao/verificar_recursos_cargo.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows unauthenticated users to access protected application functionalities and retrieve sensitive information by sending crafted HTTP requests without any session cookies or authentication tokens. Version 3.4.5 fixes the issue.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
WeGIALabRedesCefetRJ	< 3.4.5Affected

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6p76-7mm4-j5rj

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.