CVE-2026-76634

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.9.2

Description An insecure direct object reference (IDOR) exists in the employee profile page. This occurs when a request extraction function allows the id pessoa parameter to overwrite the identifier derived from the session. Authenticated attackers can exploit this by injecting the id pessoa parameter into the 'profile funcionario.php' endpoint to enumerate user identifiers and retrieve full profile data for any employee, including names, CPF, addresses, contact details, and administrative flags.

Recommendations Update WeGIA to version 3.9.2 or later. As a temporary mitigation, restrict access to the 'profile funcionario.php' endpoint or avoid using the id pessoa parameter until the update is applied.