CVE-2026-76634 describes an authorization bypass vulnerability in LabRedesCefetRJ's WeGIA product before version 3.9.2. The flaw exists in the employee profile page where an authenticated user can inject a crafted id_pessoa parameter into a request extraction function. This injection overwrites the session-derived user identifier, enabling the attacker to access arbitrary employee records. The vulnerability allows enumeration of all user IDs and exposure of sensitive personal and administrative information for any employee account.

Exploitation of this vulnerability allows authenticated attackers to bypass authorization controls and access sensitive employee information, including personally identifiable information (PII) such as name, CPF (Brazilian individual taxpayer registry identification), address, contact details, and administrative flags. This could lead to privacy violations and potential misuse of employee data. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are prior to 3.9.2, upgrading to version 3.9.2 or later is recommended once the vendor releases an official fix. Until then, restrict access to the employee profile page to trusted users and monitor for suspicious activity related to id_pessoa parameter manipulation.