CVE-2026-76634: WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all user identifiers to retrieve full profile data for any employee account, including name, CPF, address, contact details, and administrative flags.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WeGIA. The vulnerability allows such users to request employee records other than their own by supplying an id_pessoa parameter.
What information could be exposed?
An attacker can retrieve full employee profile data, including names, CPF numbers, addresses, contact details, and administrative flags. User identifiers can be enumerated to access multiple employee records.
Which versions need remediation?
WeGIA versions before 3.9.2 are affected. Updating to version 3.9.2 or later addresses the affected version range described in the advisory.