{"id":"CVE-2026-61673","kind":"vulnerability","aliases":["CVE-2026-61673"],"related":[],"title":"WeGIA: stored script injection in memorandum threads hijacks sessions","description":"WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `web/controle/memorando/DespachoControle.php` and `web/dao/memorando/DespachoDAO.php`: `FILTER_SANITIZE_SPECIAL_CHARS` is applied during storage, but `html_entity_decode()` later decodes the stored content and `jQuery .html()` inserts the result into the DOM. An attacker able to submit a memorandum dispatch through `/controle/control.php` using `DespachoControle` and `metodo=incluir` can store malicious HTML or JavaScript. The code executes automatically when another user views the memorandum thread through `/html/memorando/listar_despachos.php` with `id_memorando`. This permits arbitrary JavaScript execution, theft of administrator `PHPSESSID` session tokens, privileged session hijacking, account takeover, and unauthorized access to privileged or internal functionality. This issue is fixed in version 3.8.7.","summary":"WeGIA, a web manager for charitable institutions, stores memorandum dispatch text that is later decoded and inserted into the page without escaping. A user who can submit a dispatch can run JavaScript in the browser of anyone who views that memorandum thread, including administrators, and steal their session tokens.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted","wegia"],"not_affected_if":["memorando-module-unused","version-3.8.7-or-later"],"how_to_check":"- Check the installed WeGIA version and whether it is below `3.8.7`.\n- Look for the file `web/html/memorando/listar_despachos.php` in the WeGIA install.\n- Confirm whether the memorandum module is in use by staff accounts.","fix":"- Upgrade WeGIA to `3.8.7` or later.","status":"open","published_at":"2026-10-29T22:17:05+00:00","first_seen_at":"2026-10-29T22:27:07+00:00","triaged_at":"2026-10-29T22:28:50+00:00","updated_at":"2026-10-29T22:28:50+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-29T22:28:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade WeGIA to `3.8.7` or later.","reach":"internet","title":"WeGIA: stored script injection in memorandum threads hijacks sessions","impact":"high","summary":"WeGIA, a web manager for charitable institutions, stores memorandum dispatch text that is later decoded and inserted into the page without escaping. A user who can submit a dispatch can run JavaScript in the browser of anyone who views that memorandum thread, including administrators, and steal their session tokens.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wegia","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker steals administrator session tokens and takes over accounts","analyst_note":"","how_to_check":"- Check the installed WeGIA version and whether it is below `3.8.7`.\n- Look for the file `web/html/memorando/listar_despachos.php` in the WeGIA install.\n- Confirm whether the memorandum module is in use by staff accounts.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.8.7-or-later","memorando-module-unused"],"who_is_affected":"Any WeGIA installation before `3.8.7` that uses the memorandum dispatch feature is exposed. The attacker needs an account able to submit a dispatch, and the payload runs for whoever views the thread, so the risk is highest where administrators read memorandum threads. Installations already on `3.8.7` or later, or that do not use the memorandum module, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4397,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-61673':12A,15A '/controle/control.php':142C '/html/memorando/listar_despachos.php':166C '3.8.7':81C,200C 'abl':135C 'access':188C 'account':184C 'administr':65B,177C 'affect':101C 'anoth':159C 'anyon':58B 'appli':112C 'arbitrari':172C 'attack':134C 'automat':157C 'browser':56B 'char':110C 'charit':27B,77C 'code':155C 'content':123C 'cross':86C 'cross-sit':85C 'cve':10A,13A 'decod':36B,118C,120C 'despachocontrol':144C 'dispatch':31B,50B,140C 'dom':84C,132C 'entiti':117C 'escap':43B 'execut':156C,174C 'field':99C 'filter':107C 'fix':197C 'flow':102C 'function':193C 'handl':95C 'hijack':8A,183C 'host':20B 'html':116C,126C,151C 'id':168C 'includ':64B 'incluir':147C 'inject':4A 'insert':38B,127C 'institut':28B,78C 'intern':192C 'issu':195C 'javascript':53B,153C,173C 'jqueri':125C 'later':35B,119C 'malici':150C 'manag':25B,75C 'memorando':169C 'memorandum':6A,30B,62B,139C,163C 'metodo':146C 'page':41B 'permit':171C 'php':17B 'phpsessid':178C 'prior':79C 'privileg':181C,190C 'result':92C,129C 'run':52B 'sanit':108C 'script':3A,88C 'self':19B 'self-host':18B 'session':9A,69B,179C,182C 'site':87C 'span':103C 'special':109C 'steal':67B 'storag':114C 'store':2A,29B,83C,122C,149C 'submit':48B,137C 'takeov':185C 'text':32B 'texto':98C 'theft':175C 'thread':7A,63B,164C 'token':70B,180C 'unauthor':187C 'unsaf':94C 'use':143C 'user':45B,160C 'version':199C 'view':60B,161C 'vulner':89C 'web':24B,74C 'web/controle/memorando/despachocontrole.php':104C 'web/dao/memorando/despachodao.php':106C 'web/html/memorando/listar_despachos.php':91C 'wegia':1A,21B,22B,71C 'without':42B","nicknames":[],"mitigations":[],"who_affected":"Any WeGIA installation before `3.8.7` that uses the memorandum dispatch feature is exposed. The attacker needs an account able to submit a dispatch, and the payload runs for whoever views the thread, so the risk is highest where administrators read memorandum threads. Installations already on `3.8.7` or later, or that do not use the memorandum module, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T22:17:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61673","severity":null,"published_at":"2026-10-29T22:17:05+00:00","modified_at":"2026-10-29T22:17:05+00:00","first_seen_at":"2026-10-29T22:27:07+00:00","fetched_at":"2026-10-29T22:27:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}