rootpwn

critical · CVSS v3 8.8

CVE-2026-54671

WeGIA before version 3.8.5 contains an authorization flaw in its middleware and internal control modules. Specifically, improper permission

Overview

WeGIA before version 3.8.5 contains an authorization flaw in its middleware and internal control modules. Specifically, improper permission handling grants unconditional access to certain resources for any authenticated user, and lack of ownership validation allows manipulation of arbitrary records. This combination exposes sensitive personal, medical, and family data of charitable institution beneficiaries to low-privileged users.

Description

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5.

Impact

The vulnerability primarily impacts the confidentiality and integrity of sensitive data within charitable institutions utilizing the platform. Any authenticated low-privileged user can view, modify, or delete records belonging to other users or beneficiaries. This leads to unauthorized data exposure and potential disruption of organizational records.

Remediation

Upgrade the WeGIA application to version 3.8.5 or later where the authorization logic and ownership checks are properly enforced. Review and audit user role assignments and access control configurations within the application. Monitor application logs for unusual bulk record modifications or unauthorized data access patterns.

Risk context

This vulnerability is rated as critical with a CVSS v3 score of 8.8, indicating a high severity due to the potential for unauthorized data access and modification by low-privileged internal users. Defenders should prioritize patching, as exploitation requires only standard user authentication.

Affected products

  • WeGIA < 3.8.5

Scores

Severity
critical
CVSS v2
9
CVSS v3
8.8
CVSS v4
—
EPSS
—

IDOR authorization-bypass broken-access-control privilege-escalation web-application charity-management

← All CVEs

Related CVEs

critical

CVE-2026-62874

CVE‑2026‑62874 exposes a flaw in Azure Billing where data authenticity is not properly verified. An attacker can exploit this to gain elevated privileges on the network, potentially accessing or modifying billing and subscription data. The vulnerability is critical with a CVSS v3 score of 10.0.

View analysis

critical

CVE-2026-69843

CVE‑2026‑69843 is a critical authentication bypass in Microsoft Fabric that lets an attacker spoof credentials and gain elevated privileges across the network. The flaw allows unauthorized users to impersonate legitimate accounts, potentially accessing sensitive data and services. It is a high‑risk vulnerability that requires immediate attention from defenders.

View analysis

critical

CVE-2026-85878

CVE-2026-85878 exposes an improper authorization flaw in Azure Database for PostgreSQL that lets an authenticated user gain elevated privileges across the network. The vulnerability can be exploited by users who already have access to the database, enabling them to perform actions beyond their intended scope. It is critical because it bypasses normal role boundaries and can lead to widespread compromise of data and services.

View analysis

critical

CVE-2026-93453

SOGo versions before 5.12.11 can construct password-reset links using a client-supplied Origin header as the link authority. This can cause valid recovery tokens to be delivered in links pointing to attacker-controlled domains. It matters because it can enable account takeover for users who rely on SOGo password recovery.

View analysis