CVE-2026-23726: WeGIA Open Redirect Vulnerability

CVE-2026-23726 Overview

CVE-2026-23726 is an Open Redirect vulnerability discovered in WeGIA, a web manager for charitable institutions. The vulnerability exists in the /WeGIA/controle/control.php endpoint, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=TipoEntradaControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites.

Critical Impact

This vulnerability can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain.

Affected Products

• WeGIA versions prior to 3.6.2

Discovery Timeline

• January 16, 2026 - CVE-2026-23726 published to NVD
• January 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23726

Vulnerability Analysis

This Open Redirect vulnerability (CWE-601) occurs due to insufficient validation of user-controlled input in the WeGIA web application. The nextPage parameter in the control.php endpoint accepts arbitrary URLs without proper validation or sanitization. When a user follows a crafted link, they are redirected from the trusted WeGIA domain to an attacker-controlled destination.

The vulnerability is particularly concerning for charitable institutions that rely on WeGIA for web management, as attackers can leverage the organization's trusted domain reputation to conduct social engineering campaigns. Users who trust links originating from the WeGIA domain may unknowingly be redirected to malicious sites designed to harvest credentials or distribute malware.

Root Cause

The root cause of this vulnerability is the lack of input validation and URL whitelisting on the nextPage parameter in the /WeGIA/controle/control.php endpoint. The application directly uses user-supplied values for redirection without verifying that the destination URL belongs to a trusted domain or follows an expected pattern.

Attack Vector

An attacker exploits this vulnerability by crafting a malicious URL that includes the vulnerable WeGIA endpoint with a nextPage parameter pointing to an external, attacker-controlled website. The attack requires network access and user interaction—the victim must click on the malicious link. When combined with the metodo=listarTodos and nomeClasse=TipoEntradaControle parameters, the redirect is triggered, sending the user to the attacker's destination.

For technical details on the vulnerability and the fix, refer to the GitHub Security Advisory and the GitHub Pull Request #1333 that addresses this issue.

Detection Methods for CVE-2026-23726

Indicators of Compromise

• HTTP requests to /WeGIA/controle/control.php containing nextPage parameters with external URLs
• Log entries showing redirects from WeGIA endpoints to unfamiliar or suspicious domains
• User reports of unexpected redirections after clicking links on WeGIA-hosted pages

Detection Strategies

• Monitor web server access logs for requests to control.php containing nextPage parameters with external domain references
• Implement web application firewall (WAF) rules to detect and alert on potential open redirect patterns targeting the WeGIA endpoint
• Review HTTP referrer headers in phishing incident investigations for WeGIA domain origins

Monitoring Recommendations

• Configure alerting for unusual URL patterns in the nextPage parameter that reference external domains
• Establish baseline traffic patterns for the WeGIA application to identify anomalous redirect behavior
• Monitor for phishing campaigns that may leverage the trusted WeGIA domain as part of redirect chains

How to Mitigate CVE-2026-23726

Immediate Actions Required

• Upgrade WeGIA to version 3.6.2 or later immediately
• Review web server logs for evidence of exploitation attempts targeting the vulnerable endpoint
• Alert users about potential phishing attempts that may leverage trusted WeGIA URLs

Patch Information

The vulnerability has been fixed in WeGIA version 3.6.2. Organizations running vulnerable versions should update immediately. The fix is available through the official GitHub Release 3.6.2. Additional details about the security fix can be found in the associated pull request.

Workarounds

• Implement web application firewall rules to block or validate the nextPage parameter before reaching the application
• Restrict access to the vulnerable endpoint through network-level controls until the patch can be applied
• Educate users to verify destination URLs before entering credentials, even when links appear to originate from trusted domains

# Example WAF rule to block external redirects in nextPage parameter (ModSecurity)
SecRule ARGS:nextPage "@rx ^https?:\/\/(?!yourdomain\.com)" \
    "id:100001,phase:2,deny,status:403,msg:'Blocked potential open redirect attempt'"