CVE-2026-23731

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23731", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-15T15:45:01.956Z", "datePublished": "2026-01-16T19:50:16.344Z", "dateUpdated": "2026-01-16T20:31:29.007Z"}, "containers": {"cna": {"title": "WeGIA Clickjacking Vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-1021", "lang": "en", "description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-99qp-hjvh-c59q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-99qp-hjvh-c59q"}, {"name": "https://github.com/LabRedesCefetRJ/WeGIA/pull/1333", "tags": ["x_refsource_MISC"], "url": "https://github.com/LabRedesCefetRJ/WeGIA/pull/1333"}, {"name": "https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.2"}], "affected": [{"vendor": "LabRedesCefetRJ", "product": "WeGIA", "versions": [{"version": "< 3.6.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-16T19:50:16.344Z"}, "descriptions": [{"lang": "en", "value": "WeGIA is a web manager for charitable institutions. Prior to 3.6.2, The web application is vulnerable to clickjacking attacks. The WeGIA application does not send any defensive HTTP headers related to framing protection. In particular, X-Frame-Options is missing andContent-Security-Policy with frame-ancestors directive is not configured. Because of this, an attacker can load any WeGIA page inside a malicious HTML document, overlay deceptive elements, hide real buttons, or force accidental interaction with sensitive workflows. This vulnerability is fixed in 3.6.2."}], "source": {"advisory": "GHSA-99qp-hjvh-c59q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T20:31:08.164525Z", "id": "CVE-2026-23731", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T20:31:29.007Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23731", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T20:31:08.164525Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T20:31:22.065Z"}}], "cna": {"title": "WeGIA Clickjacking Vulnerability", "source": {"advisory": "GHSA-99qp-hjvh-c59q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "LabRedesCefetRJ", "product": "WeGIA", "versions": [{"status": "affected", "version": "< 3.6.2"}]}], "references": [{"url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-99qp-hjvh-c59q", "name": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-99qp-hjvh-c59q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/LabRedesCefetRJ/WeGIA/pull/1333", "name": "https://github.com/LabRedesCefetRJ/WeGIA/pull/1333", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.2", "name": "https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "WeGIA is a web manager for charitable institutions. Prior to 3.6.2, The web application is vulnerable to clickjacking attacks. The WeGIA application does not send any defensive HTTP headers related to framing protection. In particular, X-Frame-Options is missing andContent-Security-Policy with frame-ancestors directive is not configured. Because of this, an attacker can load any WeGIA page inside a malicious HTML document, overlay deceptive elements, hide real buttons, or force accidental interaction with sensitive workflows. This vulnerability is fixed in 3.6.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1021", "description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-16T19:50:16.344Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23731", "state": "PUBLISHED", "dateUpdated": "2026-01-16T20:31:29.007Z", "dateReserved": "2026-01-15T15:45:01.956Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-16T19:50:16.344Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "WeGIA", "vendor": "LabRedesCefetRJ", "versions": [{"status": "affected", "version": "< 3.6.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*", "matchCriteriaId": "419B3A85-5754-4198-A73E-92A9DA8E7A68", "versionEndExcluding": "3.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WeGIA is a web manager for charitable institutions. Prior to 3.6.2, The web application is vulnerable to clickjacking attacks. The WeGIA application does not send any defensive HTTP headers related to framing protection. In particular, X-Frame-Options is missing andContent-Security-Policy with frame-ancestors directive is not configured. Because of this, an attacker can load any WeGIA page inside a malicious HTML document, overlay deceptive elements, hide real buttons, or force accidental interaction with sensitive workflows. This vulnerability is fixed in 3.6.2."}, {"lang": "es", "value": "WeGIA es un gestor web para instituciones ben\u00e9ficas. Anterior a 3.6.2, la aplicaci\u00f3n web es vulnerable a ataques de clickjacking. La aplicaci\u00f3n WeGIA no env\u00eda ning\u00fan encabezado HTTP defensivo relacionado con la protecci\u00f3n contra el encuadre. En particular, falta X-Frame-Options y Content-Security-Policy con la directiva frame-ancestors no est\u00e1 configurado. Debido a esto, un atacante puede cargar cualquier p\u00e1gina de WeGIA dentro de un documento HTML malicioso, superponer elementos enga\u00f1osos, ocultar botones reales o forzar la interacci\u00f3n accidental con flujos de trabajo sensibles. Esta vulnerabilidad est\u00e1 corregida en 3.6.2."}], "id": "CVE-2026-23731", "lastModified": "2026-06-17T10:22:00.697", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23731", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T20:31:08.164525Z", "version": "2.0.3"}}]}, "published": "2026-01-16T20:15:51.327", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/LabRedesCefetRJ/WeGIA/pull/1333"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.6.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-99qp-hjvh-c59q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1021"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T05:39:25.916376+00:00", "value": {"mitigation_remediation": ["Apply the official patch by upgrading WeGIA to version\u202f3.6.2 or later.", "If upgrading is not feasible, configure the server to send framing\u2011protection headers, such as `X\u2011Frame\u2011Options: DENY` or a Content\u2011Security\u2011Policy directive `frame\u2011ancestors 'none'`, on all responses.", "Ensure that other web pages served by the same domain are also protected, and remove any existing `<iframe>` elements that load external content."], "summary": {"action": "Apply Patch", "impact": "Considerable UI Deception and Possible Unintended User Actions"}, "threat_synthesis": {"affected_systems": "LabRedesCefetRJ\u2019s WeGIA web manager is affected. Versions prior to 3.6.2 are vulnerable.", "description_and_impact": "The vulnerability allows an attacker to embed any page of the WeGIA web manager within a malicious iframe because the application fails to send framing protection headers. This omission enables clickjacking, allowing attackers to overlay deceptive content, conceal real controls, or trick users into interacting with hidden elements that trigger sensitive workflows. As a result, unauthorized or accidental actions can be performed without the user\u2019s knowledge, potentially exposing confidential data or altering system state.", "risk_and_exploitability": "The CVSS score is 4.3, indicating a low to moderate risk. The EPSS score is below 1\u202f%, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited exploitation activity. Attackers can exploit the flaw via a web\u2011based attack that hosts a malicious page containing an iframe to a vulnerable WeGIA page; no authentication or special privileges are required beyond user interaction. The risk therefore mainly stems from social engineering and UI deception rather than direct code execution."}}}}, "created": "2026-01-19T09:19:50.367618+00:00", "updated": "2026-04-18T05:45:38.173153+00:00", "vendors": ["wegia", "wegia$PRODUCT$wegia"]}