← Vulnerability feed

Vulnerability record · CVE-2026-54671 · published 17 September 2026

CVE-2026-54671: Insecure direct object reference vulnerability

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5.

8.8 CVSS 3.1 High EPSS 0.57% · top 55.1% CWE-639 · Insecure direct object referenceCWE-862 · Missing authorization Deferred
8.8CVSS 3.1 base score
0.57%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
5References
18 Sep 2026Last modified by NVD

Description

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

LinkTags
https://github.com/LabRedesCefetRJ/WeGIA/commit/767bc5fcca54b9edcbf3ac8363736e528efdfc19
https://github.com/LabRedesCefetRJ/WeGIA/issues/1640
https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.5
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-chpq-hc43-6mhw
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-chpq-hc43-6mhw

Track CVE-2026-54671 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.4CVE-2026-55255Langflow IDOR in responses endpoint allows cross-user flow executionLangflow before 1.9.1 has an insecure direct object reference in the /api/v1/responses endpoint. An authenticated attacker can supply another user's …KEVEPSS 0.89%analysed

Source: NIST National Vulnerability Database (record CVE-2026-54671), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.