A missing authentication and permission validation in the adicionar_tipo_docs_atendido.php script exposes the WeGIA system to unauthorized users. Because the script bypasses the central controller, an attacker can submit crafted requests that the application blindly accepts and persists as new records, effectively inserting large volumes of unauthorized data into the storage. This flaw permits privilege escalation to employee‑only functions and jeopardizes data integrity and confidentiality within the charitable organization’s records.

The WeGIA web manager from LabRedesCefetRJ, in any version earlier than 3.6.5, is affected. Version 3.6.5 and later include a fix that enforces proper authentication checks for this endpoint.

With a CVSS score of 9.8 the vulnerability is considered critical. The EPSS score is reported as less than 1 %, indicating a low probability of widespread exploitation at the time of analysis, and the issue is not listed in CISA’s KEV catalog. However, the attack vector is straightforward: an attacker can issue an HTTP request directly to the vulnerable script using tools such as Postman or by navigating to the script’s URL, thereby triggering the unauthorized data insertion.