CVE-2026-76634— WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php
Quick assessment
Affected
LabRedesCefetRJ WeGIA
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WeGIA 3.9.2 之前的版本在员工个人资料页面中存在一个不安全的直接对象引用（IDOR）漏洞。该漏洞允许经过身份验证的攻击者通过请求提取函数注入 参数，从而覆盖从会话中派生的标识符，进而访问任意员工的记录。攻击者可以枚举所有用户标识符，以获取任何员工账户的完整个人资料数据，包括姓名、CPF（巴西个人税务登记号）、地址、联系方式以及管理标志等信息。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1005 · Data from Local System T1115 · Clipboard DataAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| LabRedesCefetRJ | WeGIA | < 3.9.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76634
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php
Source: CVE Program / CVE List V5
Vulnerability Description
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all user identifiers to retrieve full profile data for any employee account, including name, CPF, address, contact details, and administrative flags.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| LabRedesCefetRJ | WeGIA | 0 ~ 3.9.2 | - |
|
II. Public POCs for CVE-2026-76634
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76634
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-76634 (1)
Other References for CVE-2026-76634 (1)
IV. Related Vulnerabilities
Same product: WeGIA
-
CVE-2026-76633
WeGIA < 3.9.2 Authorization Bypass Password Change via alter -
CVE-2026-45335
WeGIA: Middleware whitelist bypass → open redirect via Inter -
CVE-2026-45027
WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no s -
CVE-2026-45026
WeGIA: Stored XSS in html/atendido/processo_aceitacao.php -
CVE-2026-45025
WeGIA: Stored XSS in html/atendido/etapa_processo.php
Same vendor: LabRedesCefetRJ
-
CVE-2026-76633
WeGIA < 3.9.2 Authorization Bypass Password Change via alter -
CVE-2026-45335
WeGIA: Middleware whitelist bypass → open redirect via Inter -
CVE-2026-45027
WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no s -
CVE-2026-45026
WeGIA: Stored XSS in html/atendido/processo_aceitacao.php -
CVE-2026-45025
WeGIA: Stored XSS in html/atendido/etapa_processo.php
Same weakness: CWE-639
-
CVE-2026-5006
Vault Vulnerable to Privilege Escalation via Slash Injection -
CVE-2026-71507
Dolibarr < 24.0.0 REST API Broken Object-Level Authorization -
CVE-2026-71505
Dolibarr < 24.0.0 REST API Broken Object-Level Authorization -
CVE-2026-76073
Label Studio through 1.23.0 Cross-Organization Annotation Ac -
CVE-2026-77995
Joomla Extension - miniorange.com - Arbitrary account takeov
V. Comments for CVE-2026-76634
No comments yet