CVE-2026-54671: WeGIA: Authorization Bypass via Empty Resource Array in InternoControle
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.8.5
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WeGIA user with low privileges may be able to exploit it. The attacker does not need user interaction and can target records belonging to other people.
What access can an attacker gain or change?
An attacker can read, modify, or delete records through affected InternoControle methods such as listarUm, alterar, and excluir. Exposed data can include personal, identity, address, medical, and family information.
What condition enables the authorization bypass?
The affected controller is mapped to an empty resource array, which verificarPermissao treats as unconditional access for authenticated users. The vulnerable methods also accept attacker-controlled id or idInterno values without ownership validation.
Which versions are affected and what is the remediation?
Versions prior to 3.8.5 are affected. Upgrade to WeGIA 3.8.5, which fixes the issue.