CVE-2026-76633
A permanent, source-backed tracker page. Values are shown only when returned; explicit gaps and read failures remain different states.
What it is
ReportedWeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover. Source description excerpt; complete tracked detail loads below.
Source reported · Source: CVE record · Source last published: · Source last updated: · Tracker data as of:
What is affected
ReportedLabRedesCefetRJ — WeGIA. Product-level identification only; no affected-version conclusion is available from this field.
Source reported · Source: CVE record · Source last published: · Source last updated: · Tracker data as of:
Urgency and basis
ReportedTrack* · 215.8
Tracker computed · Tracker decision tier from the evidence detailed below · Source last updated: · Tracker data as of:
Exploitation evidence
Not reportedNot reported by tracked sources.
What to do
ReportedA source remediation link is available. Validate that guidance against the affected product and your environment.
Source remediation ↗Source reported · Tracked source remediation field · Source last updated: · Tracker data as of:
Evidence detail
Loading the full tracker evidence record…