CVE-2026-28411:

Critical authentication bypass vulnerability in WeGIA versions prior to 3.6.5 due to unsafe use of extract() function.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:Feb 27, 2026
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.7
EPSS Percentile:72%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Critical authentication bypass vulnerability in WeGIA versions prior to 3.6.5 due to unsafe use of extract() function.

Overview

The vulnerability in WeGIA stems from the improper use of the extract() function, which creates variables from array elements. By applying this function to the $_REQUEST superglobal, which contains user-supplied data, attackers can manipulate local variables within the application's PHP scripts. This manipulation allows for the complete bypass of authentication mechanisms, potentially granting full administrative access to unauthorized users. The vulnerability is classified as critical, with a CVSS v3.1 base score of 9.8, indicating a high level of severity and ease of exploitation. The attack vector is network-based, requires no privileges or user interaction, and can result in high impacts on confidentiality, integrity, and availability of the affected system.

Remediation

To address this vulnerability, users of WeGIA should immediately upgrade to version 3.6.5 or later. This version includes fixes for the unsafe use of the extract() function. If immediate upgrading is not possible, it is strongly recommended to implement additional security measures, such as restricting access to the affected application, implementing strong input validation, and monitoring for suspicious activities. Developers should avoid using the extract() function on user-supplied data and instead opt for more secure methods of handling input parameters.