CVE-2026-54767

🗓️ 17 Sep 2026 21:56:28Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 48 Views🌐 WEB

WeGIA up to 3.8.5 unauthenticated data destruction via hardcoded key in deletar_socios.php.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2026-54767	17 Sep 202623:01	–	circl
Cvelist	CVE-2026-54767 WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php	17 Sep 202621:56	–	cvelist
EUVD	EUVD-2026-82576	17 Sep 202621:56	–	euvd
Mend	CVE-2026-54767	17 Sep 202621:56	–	mend
NVD	CVE-2026-54767	17 Sep 202622:17	–	nvd
Positive Technologies	PT-2026-95160	17 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-54767: Missing Authentication for Critical Function	17 Sep 202600:00	–	rapid7
Vulnrichment	CVE-2026-54767 WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php	17 Sep 202621:56	–	vulnrichment

Vulners

Node

wegia wegiaRange<3.8.5

[
  {
    "vendor": "LabRedesCefetRJ",
    "product": "WeGIA",
    "versions": [
      {
        "version": "< 3.8.5",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/LabRedesCefetRJ/WeGIA/commit/84d9d0a7c66c29b238ab381ffcfb9e0ce260796a
github	www.github.com/LabRedesCefetRJ/WeGIA/pull/1689
github	www.github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-399w-rxhp-jh9f
github	www.github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.5

Parameter	Position	Path	Description	CWE
chave	query param	/web/html/socio/sistema/controller/deletar_socios.php	Unauthenticated GET endpoint where the 'chave' parameter is checked against a hardcoded value, allowing unauthorized TRUNCATE TABLE operations on multiple tables.	CWE-306, CWE-798

18 Sep 2026 20:17Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.1

EPSS0.00784

SSVC