CVE-2026-61671 WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-61671?
CVE-2026-61671 is a high-severity vulnerability in LabRedesCefetRJ WeGIA, published on 29 Oct 2026.
Official description
WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `extract($_REQUEST)`, including id, `idatendido`, `idInterno`, and `id_funcionario`, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. `AtendidoControle` lacks ownership checks on alterar, excluir, `listarUm`, `alterarInfPessoal`, `alterarDocumentacao`, `alterarImagem`, `alterarEndereco`, and `alterarStatus`; `InternoControle` lacks them on incluir, alterar, excluir, `listarUm`, `listarTodos`, and `listarCpf`. `FuncionarioControle` lacks ownership checks on `alterarInfPessoal`, `alterarEndereco`, `alterarDocumentacao`, `alterarImagem`, `alterarCargaHoraria`, and excluir; `VoluntarioControle` lacks them on `alterarInfPessoal`, `alterarEndereco`, `alterarDetalhes`, `alterarImagem`, and excluir. `AtendidoControle` and `InternoControle` additionally lack CSRF validation, allowing a malicious page visited by an authenticated victim to perform state-changing operations using the victim's session. `FuncionarioControle` and `VoluntarioControle` have per-method CSRF checks, but those checks do not prevent the object-authorization bypass. The advisory identifies version 3.8.7 as patched.
Which versions are affected by CVE-2026-61671?
How do I fix CVE-2026-61671?
No fix has been published for CVE-2026-61671 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-61671 being exploited?
There is no known exploitation of CVE-2026-61671 in the wild and no public exploit code.