CVE-2026-61671

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract($_REQUEST), including id, idatendido, idInterno, and id_funcionario, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. AtendidoControle lacks ownership checks on alterar, excluir, listarUm, alterarInfPessoal, alterarDocumentacao, alterarImagem, alterarEndereco, and alterarStatus; InternoControle lacks them on incluir, alterar, excluir, listarUm, listarTodos, and listarCpf. FuncionarioControle lacks ownership checks on alterarInfPessoal, alterarEndereco, alterarDocumentacao, alterarImagem, alterarCargaHoraria, and excluir; VoluntarioControle lacks them on alterarInfPessoal, alterarEndereco, alterarDetalhes, alterarImagem, and excluir. AtendidoControle and InternoControle additionally lack CSRF validation, allowing a malicious page visited by an authenticated victim to perform state-changing operations using the victim's session. FuncionarioControle and VoluntarioControle have per-method CSRF checks, but those checks do not prevent the object-authorization bypass. The advisory identifies version 3.8.7 as patched.