Authorization Flaw in WeGIA Web Management Tool for Charitable Institutions

CVE-2026-54671

What is CVE-2026-54671?

WeGIA, a web management tool designed for charitable institutions, contains an authorization vulnerability that allows low-privileged users to access, modify, or delete records belonging to other users. This flaw arises due to improper handling of user permissions within the system, particularly in the methods related to InternoControle, which accept user-controlled values without adequate ownership checks. As a result, sensitive information such as personal identity, addresses, medical records, and family details could be exposed, creating significant privacy risks. This issue has been addressed in version 3.8.5.

References