CVE-2026-28411
Authentication Bypass via Variable Overwrite in WeGIA Web Manager
Publication date: 2026-02-27
Last updated on: 2026-03-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wegia | wegia | to 3.6.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-473 | A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise. |
| CWE-288 | The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in WeGIA, a web manager for charitable institutions, in versions prior to 3.6.5. It involves the unsafe use of the PHP function extract() on the $_REQUEST superglobal. This unsafe use allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts.
By exploiting this, an attacker can bypass authentication checks completely, gaining unauthorized access to administrative and protected areas of the WeGIA application.
The issue was fixed in version 3.6.5.
How can this vulnerability impact me? :
This vulnerability can have severe impacts as it allows an unauthenticated attacker to bypass authentication controls.
An attacker exploiting this flaw can gain unauthorized access to administrative and protected areas of the WeGIA application.
Such unauthorized access can lead to full compromise of the application, including potential data theft, data manipulation, or disruption of services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade the WeGIA application to version 3.6.5 or later, as this version fixes the unsafe use of the extract() function on the $_REQUEST superglobal that allows unauthenticated attackers to bypass authentication.