WeGIA Insecure Direct Object Reference in Employee Profile

Executive Summary

CVE-2026-76634 is an Insecure Direct Object Reference (IDOR) vulnerability in WeGIA software versions prior to 3.9.2. It allows authenticated attackers to access arbitrary employee records by manipulating the id_pessoa parameter in the profile_funcionario.php file. The vulnerability stems from the use of extract($_REQUEST) which overwrites the session-derived user identifier, enabling attackers to enumerate all user IDs and retrieve full profile data including sensitive personal information.

Useful 0 Not Useful 0

Detection Guidance

Check WeGIA versions prior to 3.9.2 by inspecting the software version in your system. Look for the use of extract($_REQUEST) in profile_funcionario.php at line 28, which allows parameter injection. Test by accessing the profile page with modified id_pessoa parameters to see if unauthorized data is returned.

Commands: Check version: grep -r "WeGIA" /path/to/installation. Inspect code: grep -n "extract(\$_REQUEST)" /path/to/profile_funcionario.php. Test access: curl -u username:password "http://target/wegia/profile_funcionario.php?id_pessoa=1" and compare responses for different IDs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access sensitive employee data such as names, CPF (tax ID), addresses, contact details, and administrative permissions. Attackers can enumerate all user accounts and retrieve complete profile information for any employee, potentially leading to identity theft, fraud, or unauthorized administrative access if admin flags are exposed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates data protection regulations like GDPR and HIPAA by exposing personally identifiable information (PII) without proper authorization. GDPR requires protection of personal data and may impose fines for unauthorized access. HIPAA mandates safeguards for protected health information, which could be compromised through this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade WeGIA to version 3.9.2 or later immediately to patch the vulnerability. Remove or replace the extract($_REQUEST) function in profile_funcionario.php to prevent parameter injection. Implement strict input validation for the id_pessoa parameter to ensure it matches the authenticated user's session ID.

Restrict access to profile_funcionario.php temporarily if an upgrade is not immediately possible. Monitor logs for unusual access patterns or attempts to enumerate user IDs. Review all employee records accessed during the vulnerable period for potential data exposure.

Useful 0 Not Useful 0