PT-2026-95158

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.5 Description An authorization bypass exists where the software maps InternoControle to an empty resource array in the 'web/controle/control.php' endpoint. The verificarPermissao function in...

CVE-2026-54671: Authorization Bypass Through User-Controlled Key

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in...