# CVE-2026-76634: WeGIA insecure direct object reference in employee profile

Source: https://junglewise.ai/threats/cve-2026-76634-wegia-insecure-direct-object-reference-in-employee-profile  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76634 · Severity: medium · CVSS 6.5 · Published 2026-08-20

WeGIA is an employee management system used to maintain personnel records. An authenticated attacker can bypass access controls in the employee profile page to view confidential data belonging to any other employee, including names, tax ID numbers (CPF), addresses, contact information, and administrative status—potentially affecting hundreds of employees.

Technologies: [LabRedesCefetRJ WeGIA](https://junglewise.ai/threats/technologies/wegia). Vendors: [LabRedesCefetRJ](https://junglewise.ai/threats/vendors/labredescefetrj).

## Quick answers

**Is CVE-2026-76634 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76634 being exploited in the wild.

**How severe is CVE-2026-76634?** Medium severity, with a CVSS score of 6.5, published 20 August 2026.

**Which products and versions are affected?** LabRedesCefetRJ WeGIA before 3.9.2.

**Is there a fix for CVE-2026-76634?** A patch was published on 2026-07-20: Fix released in version 3.9.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76634 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-76634?** Check whether you run LabRedesCefetRJ WeGIA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an insecure direct object reference (IDOR) in profile_funcionario.php caused by the unsafe use of extract($_REQUEST) at line 28. This function overwrites the session-derived $id_pessoa variable with any value submitted in the HTTP request, allowing an authenticated attacker to enumerate and access arbitrary employee profiles. The vulnerable code first retrieves the user's own ID from the session, then immediately accepts and uses an attacker-supplied id_pessoa parameter for all subsequent database queries (lines 29–135). An authenticated user can simply append &id_pessoa=N to the URL, iterating through employee IDs to retrieve PII and system metadata. The vulnerability is fixed in version 3.9.2 and later by removing the dangerous extract() call and properly validating access before rendering profile data.

## Affected products

- LabRedesCefetRJ WeGIA before 3.9.2

## Timeline

- 2026-07-20: disclosed: GitHub Security Advisory GHSA-jqh5-66qr-85qv published
- 2026-08-20: disclosed: CVE-2026-76634 published on NVD
- 2026-07-20: patched: Fix released in version 3.9.2

## References

- [https://github.com/LabRedesCefetRJ/WeGIA/releases](https://github.com/LabRedesCefetRJ/WeGIA/releases)
- [https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jqh5-66qr-85qv](https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jqh5-66qr-85qv)

## Related threats

- [WeGIA stored cross-site scripting in medical records](https://junglewise.ai/threats/cve-2026-61719-wegia-is-a-web-manager-for-charitable-institutions-prior-to-3-8-7)
- [WeGIA stored DOM cross-site scripting in memorandum dispatch](https://junglewise.ai/threats/cve-2026-61673-wegia-is-a-web-manager-for-charitable-institutions-prior-to-3-8-7)
- [WeGIA pre-installation installer command injection and SQL injection](https://junglewise.ai/threats/cve-2026-55679-wegia-is-a-web-manager-for-charitable-institutions-prior-to-3-8-6)
- [WeGIA unauthenticated database truncation in member endpoint](https://junglewise.ai/threats/cve-2026-54767-wegia-unauthenticated-database-truncation-in-member-endpoint)
- [WeGIA authorization bypass in InternoControle](https://junglewise.ai/threats/cve-2026-54671-wegia-authorization-bypass-in-internocontrole)