CVE-2026-61671：WeGIA is a web manager for charitable institutions. Prior to the advis

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract($_REQUEST), including id, idatendido, idInterno, and id_funcionario, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. AtendidoControle lacks ownership checks on alterar, excluir, listarUm, alterarInfPessoal, alterarDocumentacao, alterarImagem, alterarEndereco, and alterarStatus; InternoControle lacks them on incluir, alterar, excluir, listarUm, listarTodos, and listarCpf. FuncionarioControle lacks ownership checks on alterarInfPessoal, alterarEndereco, alterarDocumentacao, alterarImagem, alterarCargaHoraria, and excluir; VoluntarioControle lacks them on alterarInfPessoal, alterarEndereco, alterarDetalhes, alterarImagem, and excluir. AtendidoControle and InternoControle additionally lack CSRF validation, allowing a malicious page visited by an authenticated victim to perform state-changing operations using the victim's session. FuncionarioControle and VoluntarioControle have per-method CSRF checks, but those checks do not prevent the object-authorization bypass. The advisory identifies version 3.8.7 as patched.

漏洞详情

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract($_REQUEST), including id, idatendido, idInterno, and id_funcionario, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. AtendidoControle lacks ownership checks on alterar, excluir, listarUm, alterarInfPessoal, alterarDocumentacao, alterarImagem, alterarEndereco, and alterarStatus; InternoControle lacks them on incluir, alterar, excluir, listarUm, listarTodos, and listarCpf. FuncionarioControle lacks ownership checks on alterarInfPessoal, alterarEndereco, alterarDocumentacao, alterarImagem, alterarCargaHoraria, and excluir; VoluntarioControle lacks them on alterarInfPessoal, alterarEndereco, alterarDetalhes, alterarImagem, and excluir. AtendidoControle and InternoControle additionally lack CSRF validation, allowing a malicious page visited by an authenticated victim to perform state-changing operations using the victim's session. FuncionarioControle and VoluntarioControle have per-method CSRF checks, but those checks do not prevent the object-authorization bypass. The advisory identifies version 3.8.7 as patched.

风险评估

• CVSS 评分：8.1（HIGH）
• 评分版本：CVSS 3.1
• 攻击向量：CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

弱点类型

CWE-352、CWE-639

参考链接

• https://github.com/LabRedesCefetRJ/WeGIA/commit/5fd072a416e3c85817f8b77d47a6d970345b0fc2
• https://github.com/LabRedesCefetRJ/WeGIA/commit/83ae8d1b417e0d8ef6a603ec5745f0967426ca6d
• https://github.com/LabRedesCefetRJ/WeGIA/issues/492
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rf87-2prr-f2p2

数据来源：NVD（美国国家漏洞数据库），入库时按 CVSS 评分筛选。

原文链接： CVE-2026-61671：WeGIA is a web manager for charitable institutions. Prior to the advis