Vulnerability · Published Aug 20, 2026 · Assigned by VulnCheck

CVE-2026-76634WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in WeGIA from LabRedesCefetRJ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 65.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all user identifiers to retrieve full profile data for any employee account, including name, CPF, address, contact details, and administrative flags.

Affected products (as reported)

Vendor	Product	Versions
LabRedesCefetRJ	WeGIA	0 – before 3.9.2

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-jqh5-66qr-85qv) vendor-advisory
Release Notes release-notes
https://www.vulncheck.com/advisories/wegia-insecure-direct-object-reference-via-profile-funcionario-php third-party-advisory