CVE-2026-23730: WeGIA Open Redirect Vulnerability

CVE-2026-23730 Overview

CVE-2026-23730 is an Open Redirect vulnerability identified in the WeGIA web manager for charitable institutions. The vulnerability exists in the /WeGIA/controle/control.php endpoint, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=ProdutoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites.

Critical Impact

This vulnerability can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain.

Affected Products

• WeGIA versions prior to 3.6.2
• WeGIA Web Manager for Charitable Institutions

Discovery Timeline

• January 16, 2026 - CVE-2026-23730 published to NVD
• January 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23730

Vulnerability Analysis

This Open Redirect vulnerability (CWE-601) occurs when the WeGIA application accepts user-controlled input in the nextPage parameter without proper validation. The vulnerable endpoint /WeGIA/controle/control.php processes redirect requests when specific parameters are supplied (metodo=listarTodos and nomeClasse=ProdutoControle). Because the application does not verify that the redirect destination is a trusted internal URL, attackers can craft malicious links that appear to originate from the legitimate WeGIA domain but redirect victims to attacker-controlled websites.

The trust relationship users have with the WeGIA domain makes this vulnerability particularly dangerous for charitable institutions using the platform, as their donors and staff may be more susceptible to phishing attempts that appear to come from a known, trusted source.

Root Cause

The root cause is improper input validation on the nextPage parameter within the control.php file. The application accepts arbitrary URL values without validating that the destination is within the expected domain or a whitelist of approved redirect targets. This allows external URLs to be passed through the application's redirect mechanism.

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious URL that leverages the trusted WeGIA domain to redirect users to an external malicious site. The attack requires network access and some user interaction (clicking the malicious link). An authenticated user context may be required to reach the vulnerable endpoint.

A typical attack scenario involves:

1. An attacker crafts a URL pointing to the vulnerable WeGIA endpoint with a malicious nextPage parameter value
2. The URL is distributed via email, social media, or other channels, appearing to be a legitimate WeGIA link
3. When a victim clicks the link, they are redirected to an attacker-controlled website
4. The attacker can then conduct phishing attacks, harvest credentials, or distribute malware

Detection Methods for CVE-2026-23730

Indicators of Compromise

• Suspicious HTTP requests to /WeGIA/controle/control.php containing external URLs in the nextPage parameter
• Web server logs showing redirect requests with parameters metodo=listarTodos, nomeClasse=ProdutoControle, and nextPage containing non-local domains
• User reports of unexpected redirects when accessing WeGIA links

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing external URLs in the nextPage parameter
• Monitor HTTP access logs for patterns matching the vulnerable endpoint with suspicious parameter combinations
• Deploy URL inspection tools to identify potentially malicious redirects in user-facing communications

Monitoring Recommendations

• Enable detailed logging for the /WeGIA/controle/control.php endpoint and related authentication flows
• Set up alerts for redirect requests containing URLs pointing to domains outside your organization's whitelist
• Review referrer headers in server logs to identify sources of malicious redirect attempts

How to Mitigate CVE-2026-23730

Immediate Actions Required

• Upgrade WeGIA to version 3.6.2 or later immediately
• Review web server logs for signs of exploitation attempts
• Notify users about potential phishing attempts leveraging WeGIA URLs
• Consider implementing additional URL validation at the network perimeter

Patch Information

The vulnerability is fixed in WeGIA version 3.6.2. Organizations should upgrade to this version or later to remediate the vulnerability. The fix is available through the GitHub Release 3.6.2. Additional details can be found in the GitHub Security Advisory GHSA-6gx4-6gwv-cxc3 and the associated Pull Request #1333.

Workarounds

• Implement a web application firewall rule to block requests to /WeGIA/controle/control.php with external URLs in the nextPage parameter
• Restrict access to the vulnerable endpoint via network segmentation until the patch can be applied
• Configure server-side validation to reject redirect targets that do not match a whitelist of approved internal URLs

# Example Apache ModSecurity rule to block external redirects
SecRule ARGS:nextPage "@rx ^https?://(?!yourdomain\.com)" \
    "id:1001,phase:2,deny,status:403,msg:'Blocked potential open redirect'"