CVE-2026-86274 Details
Description
A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability allowing unauthorized access to restricted documents has been identified in the Projeto Siga application, specifically in versions up to 11.0.2.10, 11.0.2.13, and 11.1.1. The issue arises in the ExAutenticacaoController's autenticar function, where the application fails to properly validate the 'cod' argument before issuing a JSON Web Token (JWT) for document access. This oversight allows remote attackers to manipulate the access code and bypass authorization, leading to unauthorized disclosure of document content.
It is recommended to validate the access code against the document's external-access token before issuing a JWT. Additionally, the document-level authorization check should be repeated when accessing the document stream, and metadata should not be rendered when authorization fails.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 7, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/904871 | CISA-ADP | Issue TrackingPermission Required |
| https://github.com/projeto-siga/siga/ | [email protected] | Vendor |
| https://github.com/projeto-siga/siga/issues/2493 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-86274 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/904871 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/399435 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/399435/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| projeto-siga siga | 11.0.2.10 11.0.2.13 11.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 7, 2026 | New CVE Received | [email protected] |