CVE-2026-61671

    Dashboard / Vulnerabilities / CVE-2026-61671

    CVE-2026-61671

    Published: 29 Oct 2026Last Modified: 1 Nov 2026

    Summary: WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes

    Details: WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `extract($_REQUEST)`, including id, `idatendido`, `idInterno`, and `id_funcionario`, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. `AtendidoControle` lacks ownership checks on alterar, excluir, `listarUm`, `alterarInfPessoal`, `alterarDocumentacao`, `alterarImagem`, `alterarEndereco`, and `alterarStatus`; `InternoControle` lacks them on incluir, alterar, excluir, `listarUm`, `listarTodos`, and `listarCpf`. `FuncionarioControle` lacks ownership checks on `alterarInfPessoal`, `alterarEndereco`, `alterarDocumentacao`, `alterarImagem`, `alterarCargaHoraria`, and excluir; `VoluntarioControle` lacks them on `alterarInfPessoal`, `alterarEndereco`, `alterarDetalhes`, `alterarImagem`, and excluir. `AtendidoControle` and `InternoControle` additionally lack CSRF validation, allowing a malicious page visited by an authenticated victim to perform state-changing operations using the victim's session. `FuncionarioControle` and `VoluntarioControle` have per-method CSRF checks, but those checks do not prevent the object-authorization bypass. The advisory identifies version 3.8.7 as patched.

    References: https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.7, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61671.json, https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rf87-2prr-f2p2, https://nvd.nist.gov/vuln/detail/CVE-2026-61671, https://github.com/LabRedesCefetRJ/WeGIA/issues/492, https://github.com/LabRedesCefetRJ/WeGIA/commit/5fd072a416e3c85817f8b77d47a6d970345b0fc2, https://github.com/LabRedesCefetRJ/WeGIA/commit/83ae8d1b417e0d8ef6a603ec5745f0967426ca6d

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -052a8978e4fe9b14c2b69f8a281614939c530418

    Affected versions

    3.8.5
    3.8.6
    3.8.4
    3.8.3
    3.8.2
    3.8.1
    3.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-61671 | CVE-DB