Secuno
ENNL
Book demo

CVE-2026-54671

8.8 HIGH
  1. Published17 Sept 2026

Description

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-6986510.0
Authorization bypass through user-controlled key in Microsoft Container Registry allows…
CVE-2026-545198.8
AI Agent Automation is a modular AI agent workflow automation platform with schedulers,…
CVE-2026-542398.8
Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin…
CVE-2026-615949.1
djust provides Phoenix LiveView-style reactive server-side rendering for Django with…
CVE-2026-927838.1
Yeti through 2.11.0 fails to validate caller permissions in the DELETE…
CVE-2026-927808.8
KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API…

Frequently asked

Is CVE-2026-54671 being actively exploited?

CVE-2026-54671 is not in the CISA KEV catalog.

How severe is CVE-2026-54671?

CVE-2026-54671 has a CVSS 3.1 base score of 8.8, rated high.

How do I fix CVE-2026-54671?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-54671 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.