CVE-2026-61671

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.7

Description The /controle/control.php endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters such as id, idatendido, idInterno, and id funcionario via extract($ REQUEST). Due to a lack of record ownership verification in various Controle CRUD methods, authenticated users can view, modify, or delete records belonging to other users, exposing sensitive data including CPF, RG, addresses, medical records, financial data, and employee records. Specifically, AtendidoControle lacks ownership checks on alterar(), excluir(), listarUm(), alterarInfPessoal(), alterarDocumentacao(), alterarImagem(), alterarEndereco(), and alterarStatus(); InternoControle lacks them on incluir(), alterar(), excluir(), listarUm(), listarTodos(), and listarCpf(); FuncionarioControle lacks them on alterarInfPessoal(), alterarEndereco(), alterarDocumentacao(), alterarImagem(), alterarCargaHoraria(), and excluir(); and VoluntarioControle lacks them on alterarInfPessoal(), alterarEndereco(), alterarDetalhes(), alterarImagem(), and excluir(). Additionally, AtendidoControle and InternoControle are susceptible to Cross-Site Request Forgery (CSRF), a condition where a malicious page can force an authenticated user to execute unwanted actions. While FuncionarioControle and VoluntarioControle implement per-method CSRF checks, these do not prevent the object-authorization bypass.

Recommendations Update to version 3.8.7.