CVE-2026-54767

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chave_correta value embedded in the public source repository. A remote attacker who obtains that value can reach the endpoint's TRUNCATE TABLE operations for the endereco, pessoafisica, pessoajuridica, and socio tables without an administrative session or application authorization, permanently destroying member and contributor records. The attack requires the affected tables to exist and the web process database account to possess truncation privileges. This issue is fixed in version 3.8.5.

• CWE-306
• CWE-798

• https://github.com/LabRedesCefetRJ/WeGIA/commit/84d9d0a7c66c29b238ab381ffcfb9e0ce260796a
• https://github.com/LabRedesCefetRJ/WeGIA/pull/1689
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.5
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-399w-rxhp-jh9f
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-399w-rxhp-jh9f

Published

Sep 17, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54761Traefik is an HTTP reverse proxy and load balancer. Prior to…7.1
• CVE-2026-54762Traefik is an HTTP reverse proxy and load balancer. From 3.7…8.6
• CVE-2026-54763Traefik is an HTTP reverse proxy and load balancer. Prior to…10
• CVE-2026-54764Traefik is an HTTP reverse proxy and load balancer. Prior to…5.8
• CVE-2026-54765Traefik is an open source HTTP reverse proxy and load balanc…8.5
• CVE-2026-54766Vikunja is an open-source self-hosted task management platfo…5.3
• CVE-2026-54768WPGraphQL provides a GraphQL API for WordPress sites. From 2…6.9
• CVE-2026-54769Langroid is a framework for building large-language-model-po…10
• CVE-2026-5477An integer overflow existed in the wolfCrypt CMAC implementa…7.5
• CVE-2026-54770WebOb provides objects for HTTP requests and responses. Prio…6.1
• CVE-2026-54771Langroid is a framework for building large-language-model-po…8.1
• CVE-2026-54772CoreWCF is a port of the service side of Windows Communicati…7.5