WeGIA versions before 3.8.5 have an authorization bypass vulnerability due to the way InternoControle is mapped to an empty resource array in web/controle/control.php. The verificarPermissao method in web/dao/MiddlewareDAO.php treats this empty array as unconditional access for any authenticated user. Methods in web/controle/InternoControle.php such as listarUm, alterar, and excluir accept user-controlled id or idInterno parameters without verifying ownership, enabling unauthorized access and modification of other users' sensitive data. A self-referencing load bug can crash the controller but does not mitigate the authorization flaw. The vulnerability is resolved in version 3.8.5.

Exploitation allows a low-privileged authenticated user to bypass authorization controls and access, modify, or delete records belonging to other users. This leads to exposure and potential manipulation of sensitive personal, identity, address, medical, and family information. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability.

Upgrade WeGIA to version 3.8.5 or later, where this authorization bypass vulnerability is fixed. No other mitigations are noted in the advisory. Patch status is confirmed by the vendor advisory stating the issue is fixed in 3.8.5.