CVE-2025-41111
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'id_denuncia' in '/backend/api/buscarComentariosByDenuncia.php'.
Risk Assessment
An attacker could access other users' data, potentially leading to confidentiality breaches and exposure of sensitive information.
Recommendation
Implement authorization checks verifying the user's permission to access data referenced by the 'id_denuncia' parameter and update the application to a patched version.
Other vulnerabilities in CanalDenuncia.app
See all- CVE-2025-41345High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST request with the parameters 'id_denuncia' and 'id_user' to '/backend/api/buscarDenunciasById.php'.
- CVE-2025-41344High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_archivo' parameter to '/backend/api/verArchivo.php'.
- CVE-2025-41343High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'email' parameter to '/backend/api/users/searchUserByEmail.php'.
- CVE-2025-41342High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_user' parameter to '/backend/api/buscarUsuarioId.php'.
- CVE-2025-41341High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_denuncia' and 'seguro' parameters to '/backend/api/buscarUsuarioByDenuncia.php'.
- CVE-2025-41340High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_tp_denuncia' and 'id_sociedad' parameters to '/backend/api/buscarTipoDenunciabyId.php'.
- CVE-2025-41339High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_sociedad' parameter to '/backend/api/buscarTipoDenuncia.php'.
- CVE-2025-41338High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_denuncia' and 'id_user' parameters to '/backend/api/buscarTestigoByIdDenunciaUsuario.php'.
- CVE-2025-41337High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarSSOParametros.php'.
- CVE-2025-41336High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarConfiguracionParametros.php'.
Original NVD description (English source)
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'id_denuncia' in '/backend/api/buscarComentariosByDenuncia.php'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS