Key points
- CVE-2026-55682 affects WeGIA versions prior to 3.8.6.
- The flaw enables session hijacking via manipulated cookies.
- Internal database host names are exposed in response headers.
LabRedesCefetRJ WeGIA users running versions older than 3.8.6 must apply an update immediately to address a high-severity vulnerability. The National Vulnerability Database lists CVE-2026-55682 with a CVSS score of 8.1, indicating significant risk. The issue involves improper handling of session identifiers within the web application’s security layer. Organizations using this charitable institution management tool should verify their current version and plan for immediate remediation if they are not on the latest release.
In plain English
The vulnerability exists in how WeGIA handles user sessions through cookies. Specifically, the file sessionStart.php reflects a PHPSESSID cookie value provided by an attacker directly into the Set-Cookie response. This allows a malicious actor to force a victim’s browser to use a session identifier chosen by the attacker. If the victim logs in while using this manipulated identifier, the attacker can subsequently reuse it to hijack the authenticated session. This effectively grants the attacker access to the victim’s account without needing valid credentials.
The background
Beyond the session hijacking capability, the flaw also discloses sensitive internal infrastructure information. The application uses the DB_HOST variable as the domain attribute for the session cookie. This means the internal database host name is visible in the HTTP response headers. The National Vulnerability Database categorizes this under CWE-200, which covers information exposure. Additionally, the flaw is linked to CWE-384, relating to session management issues. These weaknesses combine to create a high-risk scenario for exposed web applications.
What changes now
Version 3.8.6 of WeGIA fixes this issue. Users upgrading to this version will no longer face the risk of session hijacking via the described cookie manipulation. The update corrects the behavior of the sessionStart.php file, ensuring that attacker-supplied identifiers are not reflected in the response. It also prevents the disclosure of the internal database host name through the cookie domain attribute. Applying this patch restores proper session handling and protects internal network topology details from external exposure.
Who needs to act first
Security teams should prioritize updating any WeGIA instances that are accessible from the internet. Public-facing systems present the highest risk for session hijacking attempts. Before applying the patch, ensure you have a recent backup of the application and database. Test the update in a staging environment if possible to verify compatibility with existing integrations. Monitor authentication logs for unusual activity during the transition period. If immediate patching is not feasible, restrict access to the application through network controls.
What to do and how to stay safe: WeGIA
- Verify your current WeGIA version and compare it against the fixed release.
- Apply the update to version 3.8.6 on all affected systems.
- Review server logs for signs of session manipulation or unauthorized access.
- Restrict administrative access to trusted networks until the patch is confirmed.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-55682?
The National Vulnerability Database assigns a CVSS score of 8.1, which is rated as HIGH severity.
Which versions of WeGIA are affected by this vulnerability?
All versions of LabRedesCefetRJ WeGIA prior to version 3.8.6 are affected by this flaw.
Does this vulnerability allow remote code execution?
No, the source material describes session hijacking and information disclosure, not remote code execution.
