CVE-2026-54671: WeGIA: Authorization Bypass via Empty Resource Array in InternoControle

Published Sep 17, 2026
·
Updated

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5.

Affected Software

1 affected component
WeGIA<3.8.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade WeGIA to a version that resolves this vulnerability.

    Fixed in 3.8.5

Event History

Sep 17, 2026
CVE Published
via MITRE·09:55 PM
Data Sourced
via MITRE·09:55 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who can exploit this issue?

Any authenticated WeGIA user with low privileges may be able to exploit it. The attacker does not need user interaction and can target records belonging to other people.

2

What access can an attacker gain or change?

An attacker can read, modify, or delete records through affected InternoControle methods such as listarUm, alterar, and excluir. Exposed data can include personal, identity, address, medical, and family information.

3

What condition enables the authorization bypass?

The affected controller is mapped to an empty resource array, which verificarPermissao treats as unconditional access for authenticated users. The vulnerable methods also accept attacker-controlled id or idInterno values without ownership validation.

4

Which versions are affected and what is the remediation?

Versions prior to 3.8.5 are affected. Upgrade to WeGIA 3.8.5, which fixes the issue.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203