CVE-2026-23723
Published: 16 January 2026
Summary
CVE-2026-23723 is a high-severity SQL Injection (CWE-89) vulnerability in Wegia Wegia. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 5.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-23723 is an authenticated SQL injection vulnerability (CWE-89) affecting WeGIA, an open-source web manager for charitable institutions, in versions prior to 3.6.2. The flaw resides in the Atendido_ocorrenciaControle endpoint, where the id_memorando parameter fails to properly sanitize user input, enabling malicious SQL queries. It has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.
An attacker with high-privilege authenticated access, such as an administrative user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows full database exfiltration, exposure of sensitive personally identifiable information (PII), and potential arbitrary file reads on the server in misconfigured environments.
The vulnerability is addressed in WeGIA version 3.6.2, as detailed in the project's GitHub security advisory (GHSA-xfmp-2hf9-gfjp), the corresponding pull request (pull/1333), and the release notes. Security practitioners should urge affected organizations to upgrade immediately to mitigate risks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3114
Vulnerability details
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an authenticated SQL Injection vulnerability was identified in the Atendido_ocorrenciaControle endpoint via the id_memorando parameter. This flaw allows for full database exfiltration, exposure of sensitive PII, and potential arbitrary…
more
file reads in misconfigured environments. This vulnerability is fixed in 3.6.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in web app endpoint directly enables exploitation of public-facing application (T1190) and database data access/exfiltration (T1213.006).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of the id_memorando parameter to block malicious SQL syntax before it reaches the database.
Mandates timely application of the vendor patch (v3.6.2) that eliminates the unsanitized input flaw in Atendido_ocorrenciaControle.
Restricts the high-privilege accounts that can reach the vulnerable endpoint, reducing the population able to supply crafted id_memorando values.