{"id":"CVE-2026-61671","kind":"vulnerability","aliases":["CVE-2026-61671"],"related":[],"title":"WeGIA: any logged-in user can read and change other users' records","description":"WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `extract($_REQUEST)`, including id, `idatendido`, `idInterno`, and `id_funcionario`, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. `AtendidoControle` lacks ownership checks on alterar, excluir, `listarUm`, `alterarInfPessoal`, `alterarDocumentacao`, `alterarImagem`, `alterarEndereco`, and `alterarStatus`; `InternoControle` lacks them on incluir, alterar, excluir, `listarUm`, `listarTodos`, and `listarCpf`. `FuncionarioControle` lacks ownership checks on `alterarInfPessoal`, `alterarEndereco`, `alterarDocumentacao`, `alterarImagem`, `alterarCargaHoraria`, and excluir; `VoluntarioControle` lacks them on `alterarInfPessoal`, `alterarEndereco`, `alterarDetalhes`, `alterarImagem`, and excluir. `AtendidoControle` and `InternoControle` additionally lack CSRF validation, allowing a malicious page visited by an authenticated victim to perform state-changing operations using the victim's session. `FuncionarioControle` and `VoluntarioControle` have per-method CSRF checks, but those checks do not prevent the object-authorization bypass. The advisory identifies version 3.8.7 as patched.","summary":"WeGIA, a web manager for charitable institutions, has a dispatch endpoint that passes request parameters straight into code and skips ownership checks on record methods. An authenticated user can view, modify or delete other people's records, including CPF, RG, addresses, medical and financial data, and CSRF-style attacks can act on a logged-in victim's session.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","php","self-hosted","wegia"],"not_affected_if":["patched-3.8.7-or-later"],"how_to_check":"- Check the installed WeGIA version against the patched release `3.8.7`\n- Look for the file `/controle/control.php` in the deployment and confirm whether it still uses `extract($_REQUEST)`","fix":"- WeGIA: move to version `3.8.7` (the advisory identifies it as patched)","status":"open","published_at":"2026-10-29T22:17:05+00:00","first_seen_at":"2026-10-29T22:27:07+00:00","triaged_at":"2026-10-29T22:28:42+00:00","updated_at":"2026-10-29T22:28:42+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-29T22:28:42Z","model":"claude-haiku-5-5","output":{"fix":"- WeGIA: move to version `3.8.7` (the advisory identifies it as patched)","reach":"internet","title":"WeGIA: any logged-in user can read and change other users' records","impact":"high","summary":"WeGIA, a web manager for charitable institutions, has a dispatch endpoint that passes request parameters straight into code and skips ownership checks on record methods. An authenticated user can view, modify or delete other people's records, including CPF, RG, addresses, medical and financial data, and CSRF-style attacks can act on a logged-in victim's session.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wegia","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads, changes or deletes other users' personal and medical records","analyst_note":"","how_to_check":"- Check the installed WeGIA version against the patched release `3.8.7`\n- Look for the file `/controle/control.php` in the deployment and confirm whether it still uses `extract($_REQUEST)`\n- Unknown whether other checks are needed; sources do not say","plain_action":"","needs_analyst":false,"not_affected_if":["patched-3.8.7-or-later"],"who_is_affected":"Any WeGIA deployment running a version before 3.8.7 is exposed, because any account holder can reach the vulnerable dispatch endpoint. Systems where only trusted staff have accounts carry less practical risk, but any authenticated user can reach other users' records. Sources do not say whether non-default configuration is required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000753,"input_tokens":4614,"output_tokens":584,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-61671':16A,19A '/controle/control.php':104C '3.8.7':102C,259C 'accept':107C 'act':77B 'addit':211C 'address':66B,153C 'advisori':97C,256C 'affect':129C 'allow':215C 'alterar':166C,180C 'alterarcargahoraria':195C 'alterardetalh':204C 'alterardocumentacao':170C,193C 'alterarendereco':172C,192C,203C 'alterarimagem':171C,194C,205C 'alterarinfpesso':169C,191C,202C 'alterarstatus':174C 'anoth':146C 'atendidocontrol':161C,208C 'attack':75B,109C 'attacker-control':108C 'authent':52B,139C,222C 'author':253C 'bypass':254C 'chang':10A,228C 'charit':31B,92C 'check':47B,164C,189C,243C,246C 'code':43B 'control':110C,130C 'cpf':64B,151C 'crud':131C 'csrf':73B,213C,242C 'csrf-style':72B 'cve':14A,17A 'data':70B,157C 'delet':58B,145C 'dispatch':35B,105C 'employe':159C 'endpoint':36B,106C 'excluir':167C,181C,197C,207C 'expos':150C 'extract':118C 'financi':69B,156C 'funcionario':126C 'funcionariocontrol':186C,235C 'host':24B 'id':121C,125C 'idatendido':122C 'identifi':115C,257C 'idinterno':123C 'includ':63B,120C 'incluir':179C 'institut':32B,93C 'internocontrol':175C,210C 'lack':162C,176C,187C,199C,212C 'listarcpf':185C 'listartodo':183C 'listarum':168C,182C 'log':4A,81B 'logged-in':3A,80B 'malici':217C 'manag':29B,90C 'medic':67B,154C 'method':50B,132C,241C 'metodo':112C 'modifi':56B,143C 'nomeclass':111C 'object':252C 'object-author':251C 'oper':229C 'ownership':46B,137C,163C,188C 'page':218C 'paramet':40B,116C 'pass':38B 'patch':100C,261C 'peopl':60B 'per':240C 'per-method':239C 'perform':225C 'php':21B 'prevent':249C 'prior':94C 'read':8A 'record':13A,49B,62B,114C,136C,149C,155C,160C 'request':39B,119C 'rg':65B,152C 'self':23B 'self-host':22B 'session':85B,234C 'skip':45B 'state':99C,227C 'state-chang':226C 'straight':41B 'style':74B 'use':230C 'user':6A,12A,53B,140C,147C 'valid':214C 'verifi':135C 'version':101C,258C 'victim':83B,223C,232C 'view':55B,142C 'visit':219C 'voluntariocontrol':198C,237C 'web':28B,89C 'wegia':1A,25B,26B,86C","nicknames":[],"mitigations":[],"who_affected":"Any WeGIA deployment running a version before 3.8.7 is exposed, because any account holder can reach the vulnerable dispatch endpoint. Systems where only trusted staff have accounts carry less practical risk, but any authenticated user can reach other users' records. Sources do not say whether non-default configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T22:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61671","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61671","severity":null,"published_at":"2026-10-29T22:17:05+00:00","modified_at":"2026-10-29T22:17:05+00:00","first_seen_at":"2026-10-29T22:27:07+00:00","fetched_at":"2026-10-29T22:27:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}