The vulnerability arises from the use of extract($_REQUEST) in the /controle/control.php dispatch endpoint of WeGIA, allowing attackers to set arbitrary request parameters such as nomeClasse, metodo, and various record identifiers (id, idatendido, idInterno, id_funcionario). Because the affected Controle CRUD methods do not enforce ownership checks, any authenticated user can read, modify, or delete records belonging to other users, exposing personal documents, medical records, financial data, and employee information. Additionally, several Controle classes lack CSRF validation, permitting a malicious page visited by a victim to trigger state‑changing operations with the victim’s session, further broadening the scope of the attack.

All releases of the WeGIA web manager from LabRedesCefetRJ prior to version 3.8.7 are vulnerable. In particular the Controle classes AtendidoControle, InternoControle, FuncionarioControle, and VoluntarioControle are impacted, affecting CRUD operations such as alterar, excluir, listarUm, and others that are missing record‑ownership verification.

The CVSS score of 8.1 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session; the attacker can simply craft HTTP requests targeting the exposed parameters to bypass ownership checks. The missing CSRF protection on key endpoints makes browser‑based CSRF attacks feasible, allowing the attacker to perform these privileged actions without the victim’s conscious participation. Because the flaw is only a missing check in PHP code, no additional infrastructure or privileged access is required, making the likelihood of exploitation high for any organization running unpatched versions of WeGIA.