CVE-2026-35472 LabRedesCefetRJ CVE debrief

Who should care

Users of WeGIA version prior to 3.6.9 should apply the patch to prevent Open Redirect attacks. This includes operators, administrators, and security teams responsible for managing WeGIA deployments. They should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

CVE-2026-35472 is an Open Redirect vulnerability in the /WeGIA/controle/control.php endpoint of the WeGIA application. The vulnerability is caused by the lack of validation or restriction of the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle. This allows attackers to redirect users to arbitrary external websites, which can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM.

Defensive priority

Apply patch version 3.6.9 to prevent Open Redirect attacks.

Recommended defensive actions

• Apply patch version 3.6.9
• Validate user input
• Restrict redirects to trusted domains
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-04-06T21:16:22.040Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The WeGIA application, a Web manager for charitable institutions, is affected by this vulnerability. Users should verify their deployments and apply the patch to prevent Open Redirect attacks. The CVE record provides limited source detail, and defenders should review the official advisory for more information.

Official resources