A critical authorization flaw in WeGIA allows authenticated users to access and manipulate sensitive personal data belonging to others, posing a significant risk of data exposure.

The application incorrectly handles resource mapping in the InternoControle module, where an empty resource array leads to an authorization bypass. Any authenticated user can interact with methods such as listarUm, alterar, and excluir to perform unauthorized operations on records they do not own.

This vulnerability carries a high CVSS score of 8.8, reflecting its potential to result in complete loss of confidentiality, integrity, and availability for the affected records. Unauthorized access can lead to the exposure of highly sensitive personal, identity, medical, and family information, which may result in severe reputational damage, legal consequences, and a breach of privacy regulations.

Immediate Action: Upgrade the WeGIA installation to version 3.8.5 or later to resolve the underlying authorization logic error.

Proactive Monitoring: Review application access logs for unusual patterns, such as a single user ID accessing an abnormally high number of unique record identifiers in a short timeframe.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to monitor for suspicious parameter manipulation attempts in requests targeting the InternoControle controller.

Public Exploit Available: No (exploit_available: unknown)

Given the ease of exploitation for any authenticated user and the sensitivity of the data handled by WeGIA, this vulnerability poses a severe risk to institutional security. Administrators must prioritize the update to version 3.8.5 immediately to prevent unauthorized data access and manipulation.