CVE-2026-54671

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.5

Description An authorization bypass exists where the software maps InternoControle to an empty resource array in the 'web/controle/control.php' endpoint. The verificarPermissao() function in 'web/dao/MiddlewareDAO.php' incorrectly treats this empty array as granting unconditional access to all authenticated users. Consequently, the listarUm(), alterar(), and excluir() functions in 'web/controle/InternoControle.php' process user-controlled id or idInterno variables without verifying ownership. This allows low-privileged users to read, modify, or delete records belonging to other individuals, potentially exposing personal, identity, address, medical, and family information.

Recommendations Update to version 3.8.5.