Auth bypass in Labredescefetrj Wegia
CVE-2025-30361
WeGIA is a Web manager for charitable institutions. A security vulnerability was identified in versions prior to 3.2.6, where it is possible to change a user's password without verifying the old password. This issue exists in the control.php endpoint and allows unauthorized attackers to bypass authentication and authorization mechanisms to reset the password of any user, including admin accounts. Version 3.2.6 fixes the issue.
Vulnerability class: Broken Authentication
EPSS: 0.005 (41.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Labredescefetrj Wegia — versions < 3.2.6
- Wegia
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-30361?
- CVE-2025-30361 is a critical-severity vulnerability in Labredescefetrj Wegia, classified under Improper Authentication. CVSS score: 9.8/10. Published 2025-03-27.
- How severe is CVE-2025-30361?
- Critical severity. CVSS v3 base score is 9.8 out of 10.