LabRedesCefetRJ WeGIA up to 3.8.6 AtendidoControle /controle/control.php AtendidoControle.alterar authorization

Summaryinfo

A vulnerability was found in LabRedesCefetRJ WeGIA up to 3.8.6. It has been rated as critical. Impacted is the function AtendidoControle.alterar of the file /controle/control.php of the component AtendidoControle. This manipulation of the argument nomeClasse/metodo/id/idatendido/idInterno/id_funcionario causes authorization. This vulnerability is registered as CVE-2026-61671. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in LabRedesCefetRJ WeGIA up to 3.8.6. It has been declared as critical. Affected by this vulnerability is the function AtendidoControle.alterar of the file /controle/control.php of the component AtendidoControle. The manipulation of the argument nomeClasse/metodo/id/idatendido/idInterno/id_funcionario with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `extract($_REQUEST)`, including id, `idatendido`, `idInterno`, and `id_funcionario`, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. `AtendidoControle` lacks ownership checks on alterar, excluir, `listarUm`, `alterarInfPessoal`, `alterarDocumentacao`, `alterarImagem`, `alterarEndereco`, and `alterarStatus`; `InternoControle` lacks them on incluir, alterar, excluir, `listarUm`, `listarTodos`, and `listarCpf`. `FuncionarioControle` lacks ownership checks on `alterarInfPessoal`, `alterarEndereco`, `alterarDocumentacao`, `alterarImagem`, `alterarCargaHoraria`, and excluir; `VoluntarioControle` lacks them on `alterarInfPessoal`, `alterarEndereco`, `alterarDetalhes`, `alterarImagem`, and excluir. `AtendidoControle` and `InternoControle` additionally lack CSRF validation, allowing a malicious page visited by an authenticated victim to perform state-changing operations using the victim's session. `FuncionarioControle` and `VoluntarioControle` have per-method CSRF checks, but those checks do not prevent the object-authorization bypass. The advisory identifies version 3.8.7 as patched.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-61671 since 07/10/2026. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

By approaching the search of inurl:controle/control.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 3.8.7 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• LabRedesCefetRJ

Name

• WeGIA

Version

• 3.8.0
• 3.8.1
• 3.8.2
• 3.8.3
• 3.8.4
• 3.8.5
• 3.8.6

Website

• Product: https://github.com/LabRedesCefetRJ/WeGIA/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion