HIGH 7.1 NVD
CVE-2026-76634
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitra
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all user identifiers to retrieve full profile data for any employee account, including name, CPF, address, contact details, and administrative flags.
References
- https://github.com/LabRedesCefetRJ/WeGIA/releases#release-3.9.2
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jqh5-66qr-85qv
- https://www.vulncheck.com/advisories/wegia-insecure-direct-object-reference-via-profile-fu
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jqh5-66qr-85qv
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-08-20 via NVD.
vulnfeed aggregates 11502 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.