CVE-2026-86274: Missing Authorization in projeto-siga siga

This vulnerability affects the Authentication Flow of projeto-siga siga in the ExAutenticacaoController.autenticar function located in sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java. Manipulation of the cod/jwt argument can bypass authorization checks, resulting in missing authorization. The issue is remotely exploitable without privileges or user interaction. The vulnerability has been publicly disclosed, and the project was informed early but has not yet responded or provided a fix.

Successful exploitation allows an attacker to bypass authorization controls remotely, potentially gaining unauthorized access to protected resources or functionality within the affected versions of the projeto-siga siga product. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a patch is available, consider restricting access to the affected authentication endpoint or implementing additional access controls as a temporary mitigation.