Web Manager for Charitable Institutions Exposes Sensitive Data due to Improper Access Control

CVE-2026-61671

What is CVE-2026-61671?

WeGIA, a web management tool for charitable institutions, contains a vulnerability that allows authenticated users to access, modify, or delete records belonging to other users without proper ownership verification. The issues arise within the Controle CRUD methods where parameters are passed without adequate checks, potentially exposing sensitive data like personal identification numbers, addresses, medical records, and financial information. Additionally, the lack of CSRF validation on certain endpoints allows attackers to execute state-changing operations via the victim's session. This vulnerability underscores the critical need for implementations that enforce strict ownership checks and CSRF protections to safeguard user data.

References