CVE-2025-61665: WeGIA: Broken Access Control in `get_relatorios_socios.php` Endpoint
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the getrelatoriossocios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and financial information of members without requiring authentication or authorization. This issue is fixed in version 3.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61665?
CVE-2025-61665 is classified as a high severity vulnerability due to its potential for unauthorized access to sensitive data.
How do I fix CVE-2025-61665?
To fix CVE-2025-61665, update WeGIA to version 3.4.13 or later which addresses the broken access control issue.
What type of vulnerability is CVE-2025-61665?
CVE-2025-61665 is a Broken Access Control vulnerability that allows unauthorized users to access sensitive endpoints.
Which versions of WeGIA are affected by CVE-2025-61665?
Versions of WeGIA up to and including 3.4.12 are affected by CVE-2025-61665.
What endpoint is impacted by CVE-2025-61665?
The impacted endpoint in CVE-2025-61665 is get_relatorios_socios.php, which allows unauthenticated access.