CVE-2026-54671— WeGIA: Authorization Bypass via Empty Resource Array in InternoControle
Quick assessment
Affected
LabRedesCefetRJ WeGIA
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WeGIA 是一款面向慈善机构使用的 Web 管理系统。在 3.8.5 版本之前，WeGIA 在 文件中将 映射到一个空的资源数组；而 中的 函数将该空数组视为对所有已认证用户无条件授予访问权限。 中的方法（包括 、 和 ）接受用户控制的 或 值，但未验证资源所有权，导致权限较低的用户可以读取、修改或删除他人的记录，从而暴露个人身份信息、地址、医疗及家庭等敏感数据。 安全公告指出，在报告的版本中，存在一个自我引用的加载 bug，可能导致该控制器崩溃；但空资源授权模式以及受影响的方法仍被视为当前审查的核心漏洞。该问题
Possible ATT&CK Techniques 3 AI
T1078 · Valid Accounts T1213 · Data from Information Repositories T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54671
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WeGIA: Authorization Bypass via Empty Resource Array in InternoControle
Source: CVE Program / CVE List V5
Vulnerability Description
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| LabRedesCefetRJ | WeGIA | < 3.8.5 | - |
|
II. Public POCs for CVE-2026-54671
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54671
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54671 (1)
-
issue [#1640] concluida · LabRedesCefetRJ/WeGIA@767bc5f · GitHub x_refsource_MISC
Other References for CVE-2026-54671 (3)
-
Release 3.8.5 · LabRedesCefetRJ/WeGIA · GitHub x_refsource_MISC
Same Patch Batch · LabRedesCefetRJ · 2026-09-17 · 3 CVEs total
| CVE-2026-54767 | 9.1 CRITICAL | WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php |
| CVE-2026-54670 | 9.1 CRITICAL | WeGIA: Unauthenticated Auth Bypass + Local File Inclusion |
IV. Related Vulnerabilities
Same product: WeGIA
-
CVE-2026-54767
WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction -
CVE-2026-54670
WeGIA: Unauthenticated Auth Bypass + Local File Inclusion -
CVE-2026-76634
WeGIA < 3.9.2 Insecure Direct Object Reference via profile_f -
CVE-2026-76633
WeGIA < 3.9.2 Authorization Bypass Password Change via alter -
CVE-2026-45335
WeGIA: Middleware whitelist bypass → open redirect via Inter
Same vendor: LabRedesCefetRJ
-
CVE-2026-54767
WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction -
CVE-2026-54670
WeGIA: Unauthenticated Auth Bypass + Local File Inclusion -
CVE-2026-76634
WeGIA < 3.9.2 Insecure Direct Object Reference via profile_f -
CVE-2026-76633
WeGIA < 3.9.2 Authorization Bypass Password Change via alter -
CVE-2026-45335
WeGIA: Middleware whitelist bypass → open redirect via Inter
Same weakness: CWE-639
-
CVE-2026-18441
LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unau -
CVE-2026-69865
Microsoft Container Registry Elevation of Privilege Vulnerab -
CVE-2026-73999
WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object R -
CVE-2026-66575
WordPress King Addons for Elementor plugin <= 51.1.81 - Inse -
CVE-2026-82685
Confirmation token accepted on any record in AshAuthenticati
V. Comments for CVE-2026-54671
No comments yet