Description

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all user identifiers to retrieve full profile data for any employee account, including name, CPF, address, contact details, and administrative flags.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T14:17:59.837Z",
  "pubdate": "2026-08-20T14:17:59.837Z",
  "executiveSummary": "WeGIA before 3.9.2 suffers from an Insecure Direct Object Reference (IDOR) vulnerability residing within the employee profile page. This security flaw enables authenticated malicious actors to bypass access controls and retrieve arbitrary employee records. By supplying a manipulated identifier parameter during request extraction, attackers can successfully overwrite the session-derived user context. The business impact of this vulnerability is severe, as it permits unauthorized enumeration and extraction of sensitive personnel data. Exposed information includes full names, CPFs, residential addresses, private contact details, and administrative privilege flags. The vulnerability lowers the barrier for internal reconnaissance and data exfiltration. Successful exploitation requires prior authentication within the application, but no administrative privileges are mandated. The attack leverages predictable sequential or brute-forceable identifiers to harvest complete profile datasets across the entire user base of the affected system.",
  "technicalDetails": "The root cause of this vulnerability stems from improper handling and validation of object references within the employee profile management logic of WeGIA before 3.9.2. Specifically, the application implements a request extraction function that insecurely processes input parameters, allowing user-supplied data to overwrite internal session-derived identifiers. Under normal operational conditions, the application should derive the target employee record directly from the cryptographically secure server-side session tokens established during authentication, ensuring that users can only access their own profile data. However, the introduction of the id_pessoa parameter via HTTP requests permits attackers to manipulate the database query or application logic directly.\nThe exploitation method relies on parameter injection targeting the employee profile retrieval mechanism. The attack flow initiates when an authenticated attacker intercepts or crafts a Hypertext Transfer Protocol request directed at the employee profile page. The attacker appends or modifies the id_pessoa parameter within the request data. Due to the vulnerable request extraction function, the application blindly accepts this externally controlled value, replacing the authenticated session identifier with the attacker-specified target value. By systematically incrementing, decrementing, or otherwise enumerating the id_pessoa parameter values, the attacker can iterate through the database keys associated with employee records.\nThe vulnerable component involves the server-side parameter parsing and session management logic handling employee profile requests. The affected versions include all WeGIA deployments prior to version 3.9.2. The authentication requirement is limited to possessing a valid, authenticated low-privileged user session within the platform, meaning any standard user or compromised account can execute the flaw. Privilege requirements are minimal, as the broken access control mechanism fails to verify whether the authenticated user possesses authorization to view the requested personnel record. Network exposure encompasses any environment where the WeGIA application is accessible to authenticated users over the network.\nThe payload behavior involves injecting arbitrary integer or string values into the id_pessoa field to force the backend database to return records belonging to other users. Post-exploitation impact includes mass data exfiltration of Personally Identifiable Information (PII), exposure of internal administrative flags which may facilitate further privilege escalation attacks, and total compromise of confidentiality for all registered employees within the application database."
}