Vulnerability · Published Oct 2, 2025 · Assigned by GitHub_M

CVE-2025-61665WeGIA: Broken Access Control in `get_relatorios_socios.php` Endpoint

High 8.7

In plain English

A high-severity improper authentication in WeGIA from LabRedesCefetRJ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 58.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the get_relatorios_socios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and financial information of members without requiring authentication or authorization. This issue is fixed in version 3.5.0.

Affected products (as reported)

Vendor	Product	Versions
LabRedesCefetRJ	WeGIA	< 3.5.0

Weakness: CWE-287, CWE-200 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-62wp-6qmh-6p5f x_refsource_CONFIRM
https://github.com/LabRedesCefetRJ/WeGIA/commit/828f23a6a760a52b8bb8bfd583cc2b23c42da51e x_refsource_MISC