CVE-2026-61671: High severity vulnerability
WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract($REQUEST), including id, idatendido, idInterno, and idfuncionario, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. AtendidoControle lacks ownership checks on alterar, excluir, listarUm, alterarInfPessoal, alterarDocumentacao, alterarImagem, alterarEndereco, and alterarStatus; InternoControle lacks them on incluir, alterar, excluir, listarUm, listarTodos, and listarCpf. FuncionarioControle lacks ownership checks on alterarInfPessoal, alterarEndereco, alterarDocumentacao, alterarImagem, alterarCargaHoraria, and excluir; VoluntarioControle lacks them on alterarInfPessoal, alterarEndereco, alterarDetalhes, alterarImagem, and excluir. AtendidoControle and InternoControle additionally lack CSRF validation, allowing a malicious page visited by an authenticated victim to perform state-changing operations using the victim's session. FuncionarioControle and VoluntarioControle have per-method CSRF checks, but those checks do not prevent the object-authorization bypass. The advisory identifies version 3.8.7 as patched.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.8.7
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WeGIA user can exploit the missing ownership checks by targeting another user's record identifiers. The exposed records include beneficiary, internal, employee, and volunteer data.
What access or request control is required for exploitation?
The attacker needs an authenticated session and the ability to send requests to `/controle/control.php` with controlled dispatch and record identifier parameters. The affected endpoint accepts parameters including `nomeClasse`, `metodo`, `id`, `idatendido`, `idInterno`, and `id_funcionario` through `extract($_REQUEST)`.
What can an attacker do with another user's record identifier?
Depending on the affected controller and method, an attacker can view, modify, or delete another user's records. Impacted data includes CPF, RG, addresses, medical records, financial data, and employee records.
Are there additional request-forgery concerns?
Yes. `AtendidoControle` and `InternoControle` additionally lack CSRF validation, so actions against those controllers may be triggerable through forged requests in an authenticated user's browser.
Which versions are affected?
Versions prior to the advisory's stated patched version 3.8.7 are affected.