CVE-2026-54670 Details

A vulnerability in WeGIA, a web management tool for charitable organizations, allows for unauthenticated authentication bypass and local file inclusion. This issue exists in versions prior to 3.8.5, specifically within the contribution request dispatcher located at web/html/contribuicao/controller/control.php. The vulnerability arises because the dispatcher accepts attacker-controlled 'nomeClasse' and 'metodo' values without a complete allowlist, exempts sensitive 'ContribuicaoLogController' operations from authentication, and constructs a controller include path based on user input without proper sanitization. As a result, an unauthenticated remote attacker can invoke sensitive methods to access contribution and donation records or initiate financial operations. Additionally, the 'nomeClasse' parameter can be manipulated to include accessible PHP or configuration files from outside the intended directory, potentially exposing source code, credentials, or other sensitive data.

Users can update to WeGIA version 3.8.5, which addresses this vulnerability by adding proper authentication checks and sanitizing user input to prevent path traversal and unauthorized file inclusions.