WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract($_REQUEST), including id, idatendido, idInterno, and id_funcionario, while the affected Controle CRUD methods do not verify record ownership. Any authenticated user can view, modify, or delete another user's records, exposing CPF, RG, addresses, medical records, financial data, and employee records. AtendidoControle lacks ownership checks on alterar, excluir, listarUm, alterarInfPessoal, alterarDocumentacao, alterarImagem, alterarEndereco, and alterarStatus; InternoControle lacks them on incluir, alterar, excluir, listarUm, listarTodos, and…