This vulnerability is an instance of CWE-620 and CWE-862. WeGIA before version 3.9.2 contains an authorization bypass that allows any authenticated user to change the account password without providing the current password. The flaw originates in the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. By manipulating the redir parameter to point to alterar_senha.php, the request is routed through verificarSenhaConfig() rather than verificarSenha(), which bypasses the verification of the existing password and enables the attacker to convert a temporary session into a permanent account takeover.

All installations of WeGIA by LabRedesCefetRJ running a version earlier than 3.9.2 are impacted. The vulnerability lies in core control logic and the alterarsenha handling code, affecting every authenticated user on those systems.

The flaw scores a CVSS of 8.6, indicating high severity, and it is not listed in the CISA KEV catalog. No EPSS data is available, so the exploitation probability cannot be quantified. An attacker only needs an authenticated session and the ability to craft an HTTP request that modifies the redir parameter. Successful exploitation results in an unauthorized password reset and full control over the victim’s account, effectively a full privilege escalation within the application.