EUVD-2026-63359
GHSA-56r8-9xc4-3g79
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with any WeGIA employee account
-
DeliveryAccess employee profile page
-
ExploitIntercept HTTP request via proxy
-
ExecutionInject arbitrary id_pessoa parameter value
-
PersistEnumerate sequential employee IDs
-
ImpactExfiltrate full PII records for all employees
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated session in WeGIA - any employee-level account suffices; no administrative privileges are needed. The attacker must be able to reach the employee profile page ( |
| Impact | The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) accurately reflects the threat profile: low-complexity network exploitation requiring only a valid user session, with high confidentiality impact on the vulnerable system. No scope change to subsequent systems is claimed. EPSS data was not provided in the available intelligence; however, given that no KEV listing exists and no public POC has been identified, opportunistic mass exploitation is not currently evidenced. The realistic risk is highest in organizations where WeGIA manages sensitive workforce data - the exposed fields (CPF, home address, admin flags) constitute regulated PII under Brazilian LGPD, making even a single unauthorized read a potential compliance incident. The CVSS vector is internally consistent with the description: PR:L correctly models the authentication requirement, and VC:H reflects the breadth of PII exposed per record combined with the ability to enumerate all records. |
| Exploit ScenarioDerived | An attacker with any valid WeGIA employee account navigates to the employee profile page and intercepts the outbound request using a web proxy. They replace the session-derived |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Insecure direct object reference in WeGIA's employee profile page allows any authenticated low-privileged user to enumerate and retrieve full employee records belonging to other accounts. Affected versions are all WeGIA releases before 3.9.2. Exploitation exposes sensitive PII - including CPF numbers, addresses, contact details, and administrative flags - for every employee record in the system. No public exploit code or active exploitation confirmed at time of analysis; a vendor-released patch is available.
RemediationAI
Upgrade WeGIA to version 3.9.2 or later, which resolves the authorization bypass in the employee profile page. The patched release is available at https://github.com/LabRedesCefetRJ/WeGIA/releases and the full security advisory is published at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jqh5-66qr-85qv. If an immediate upgrade is not feasible, restrict access to the WeGIA employee profile endpoint to only trusted internal networks or enforce session-scoped server-side authorization checks on the id_pessoa parameter as a compensating control - note this workaround requires code-level modification and may not be practical for unpatched deployments. Additionally, audit access logs for anomalous sequential or high-volume profile requests from single sessions to detect potential prior exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WeGIA is a Brazilian web-based employee and HR management system developed by LabRedesCefetRJ. CWE-639 (Authorization Bypass Through User-Controlled Key) describes the root cause: the application uses a client-supplied identifier (id_pessoa) to look up employee profile records without verifying that the requesting session is authorized to access the requested record. A request extraction function overwrites the session-derived identifier with the attacker-supplied value, bypassing the implicit ownership check that session binding is intended to enforce. This is a classic IDOR pattern where horizontal privilege escalation is possible across all employee accounts in the database.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-accessible IDOR requiring only a valid low-privilege session; high confidentiality impact from full PII enumeration; no integrity or availability impact applies.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all user identifiers to retrieve full profile data for any employee account, including name, CPF, address, contact details, and administrative flags.
Executive ViewAI
WeGIA versions before 3.9.2 contain an insecure direct object reference vulnerability enabling any low-privileged employee to retrieve sensitive personal data for all other employees in the organization, including tax identification numbers, addresses, and administrative flags. This creates organization-wide privacy exposure and compliance risk. Immediate patching is essential to prevent unauthorized workforce data disclosure and avoid regulatory penalties.
Apply vendor patch (version 3.9.2). Until deployment, restrict access to employee profile endpoints and audit logs for enumeration attempts. Requires low-privileged authentication; no public exploit identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB