---
id: "CVE-2026-61671"
kind: "vulnerability"
aliases: ["CVE-2026-61671"]
title: "WeGIA: any logged-in user can read and change other users' records"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "php", "self-hosted", "wegia"]
not_affected_if: ["patched-3.8.7-or-later"]
published_at: "2026-10-29T22:17:05+00:00"
first_seen_at: "2026-10-29T22:27:07+00:00"
updated_at: "2026-10-29T22:28:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61671", "first_seen_at": "2026-10-29T22:27:07+00:00"}]
---

# WeGIA: any logged-in user can read and change other users' records

WeGIA, a web manager for charitable institutions, has a dispatch endpoint that passes request parameters straight into code and skips ownership checks on record methods. An authenticated user can view, modify or delete other people's records, including CPF, RG, addresses, medical and financial data, and CSRF-style attacks can act on a logged-in victim's session.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WeGIA version against the patched release `3.8.7`
- Look for the file `/controle/control.php` in the deployment and confirm whether it still uses `extract($_REQUEST)`

## Fix

- WeGIA: move to version `3.8.7` (the advisory identifies it as patched)

## Timeline

- 2026-10-29T22:27:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-61671

## From the sources

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `extract($_REQUEST)`, including id, `idatendido`, `idInterno`, and `id_funcionario`, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. `AtendidoControle` lacks ownership checks on alterar, excluir, `listarUm`, `alterarInfPessoal`, `alterarDocumentacao`, `alterarImagem`, `alterarEndereco`, and `alterarStatus`; `InternoControle` lacks them on incluir, alterar, excluir, `listarUm`, `listarTodos`, and `listarCpf`. `FuncionarioControle` lacks ownership checks on `alterarInfPessoal`, `alterarEndereco`, `alterarDocumentacao`, `alterarImagem`, `alterarCargaHoraria`, and excluir; `VoluntarioControle` lacks them on `alterarInfPessoal`, `alterarEndereco`, `alterarDetalhes`, `alterarImagem`, and excluir. `AtendidoControle` and `InternoControle` additionally lack CSRF validation, allowing a malicious page visited by an authenticated victim to perform state-changing operations using the victim's session. `FuncionarioControle` and `VoluntarioControle` have per-method CSRF checks, but those checks do not prevent the object-authorization bypass. The advisory identifies version 3.8.7 as patched.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_