projeto-siga vulnerabilities and threats

CVE-2026-86274 is a medium severity vulnerability in the projeto-siga siga product affecting versions 11.0.2.0 through 11.0.2.13 and 11.1.0 through 11.1.1. It involves missing authorization in the Authentication Flow component, specifically in the ExAutenticacaoController.autenticar function. The flaw allows remote attackers to manipulate authentication arguments leading to unauthorized access. The vulnerability has been publicly disclosed, but no official patch or vendor response is currently available.

A weakness has been identified in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java of the component HTML-to-PDF Endpoint. This manipulation of the argument html causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in projeto-siga siga 11.0.3.18. The affected element is an unknown function of the file /sigawf/app/responsavel/novo. Performing a manipulation of the argument Nome/Descrição results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.