CVE-2026-54671 Details
Description
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5.
A vulnerability in WeGIA, a web management tool for charitable organizations, prior to version 3.8.5, allows authorization bypass through an empty resource array mapping. The issue arises in 'web/controle/control.php' and 'web/dao/MiddlewareDAO.php', where the empty array is interpreted as granting full access to all authenticated users. This flaw enables low-privileged users to exploit methods in 'web/controle/InternoControle.php' that handle user-controlled identifiers without verifying ownership. As a result, it is possible to read, modify, or delete records belonging to others, exposing sensitive personal information such as identity details, addresses, medical records, and family information.
WeGIA version 3.8.5 addresses this vulnerability by mapping the 'InternoControle' resource to a non-empty array, ensuring that authorization checks are enforced. Users should update to this version to mitigate the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-chpq-hc43-6mhw | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/commit/767bc5fcca54b9edcbf3ac8363736e528efdfc19 | [email protected] | Source CodeVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/issues/1640 | [email protected] | Issue TrackingTechnical AnalysisVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.5 | [email protected] | Release NotesVendor |
| https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-chpq-hc43-6mhw | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WeGIA | <= 3.8.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |