« Volver al listado

CVE-2026-54671

Estado: AplazadaAlta (8.8)—

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user.

Leer descripción completaMostrar menos

The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de control de acceso en aplicación web expuesta (T1190). Usuario autenticado explota ausencia de validación de propiedad para leer, modificar y eliminar registros personales, médicos e identitarios (T1552.007, T1565.001, T1078.001). Requiere autenticación previa pero sin privilegios e

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementNetwork SegmentationVulnerability ScanningUser Account ManagementThreat Intelligence ProgramRestrict File and Directory Permissions

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Wegia — WegiaAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-54671",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54671",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-18T13:08:49.482367Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "LabRedesCefetRJ",
          "product": "WeGIA",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.8.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-17T22:17:03.150",
  "references": [
    {
      "url": "https://github.com/LabRedesCefetRJ/WeGIA/commit/767bc5fcca54b9edcbf3ac8363736e528efdfc19",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/LabRedesCefetRJ/WeGIA/issues/1640",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.8.5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-chpq-hc43-6mhw",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-chpq-hc43-6mhw",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5."
    }
  ],
  "lastModified": "2026-09-18T13:18:33.920",
  "sourceIdentifier": "security-advisories@github.com"
}