CVE-2026-35398 describes an Open Redirect vulnerability in the WeGIA web manager for charitable institutions. The vulnerability is located in the nextPage parameter of the /WeGIA/controle/control.php endpoint when combined with metodo=listarTodos & listarId_Nome and nomeClasse=OrigemControle. The application does not validate or restrict the nextPage parameter, enabling attackers to redirect users to untrusted external websites. This can be exploited for social engineering attacks leveraging the trusted WeGIA domain. The vulnerability affects versions prior to 3.6.9 and is resolved in version 3.6.9.

Successful exploitation allows attackers to redirect users from the legitimate WeGIA domain to arbitrary external URLs. This can be abused for phishing attacks, credential theft, malware distribution, and other social engineering attacks. The vulnerability does not require privileges or user interaction beyond clicking a crafted link. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, no privileges required, but requires user interaction.

This vulnerability is fixed in WeGIA version 3.6.9. Users and administrators should upgrade to version 3.6.9 or later to remediate this issue. No other official remediation level or temporary fix is indicated. Patch status is confirmed by the vendor information stating the fix is included in version 3.6.9.