THREAT OPS › Threat News › [NVD] CVE-2026-76634 (MEDIUM 6.5) — WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the sessio
[NVD] CVE-2026-76634 (MEDIUM 6.5) — WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the sessio
CVE-2026-76634 CVSS: 6.5 MEDIUM Published: 2026-08-20T14:17:59.837
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all us
Indicators of compromise
- CVE-2026-76634cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-76634