Account takeover via unverified password change

Authorization bypass in WeGIA before 3.9.2 allows remote authenticated users to take over their own accounts via password change. In control.php, the alterarSenha method is exempted from the normal permission check, and FuncionarioControle::alterarSenha follows the redir=alterar_senha.php path into verificarSenhaConfig(), which checks only the new password and confirmation instead of the current password. Any attacker holding a temporary authenticated session can persist access by resetting that same account's password; the published proof of concept shows cross-user password changes are blocked.