CVE-2026-86274

MEDIUM 5.3

projeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-862 CWE-863
Vendor	projeto-siga
Product	siga
Published	Sep 7, 2026
Last Updated	Sep 8, 2026

Stay Ahead of the Next One

Get instant alerts for projeto-siga siga

Be the first to know when new medium vulnerabilities affecting projeto-siga siga are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

projeto-siga / siga

11.0.2.0 11.0.2.1 11.0.2.2 11.0.2.3 11.0.2.4 11.0.2.5 11.0.2.6 11.0.2.7 11.0.2.8 11.0.2.9 11.0.2.10 11.0.2.11 11.0.2.12 11.0.2.13 11.1.0 11.1.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/399435 vuldb.com: https://vuldb.com/vuln/399435/cti vuldb.com: https://vuldb.com/cve/CVE-2026-86274 vuldb.com: https://vuldb.com/submit/904871 github.com: https://github.com/projeto-siga/siga/issues/2493 github.com: https://github.com/projeto-siga/siga/

Credits

🔍 volksec (VulDB User) VulDB CNA Team