CVE-2025-41338
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_denuncia' and 'id_user' parameters to '/backend/api/buscarTestigoByIdDenunciaUsuario.php'.
Risk Assessment
Unauthorized access to witness data linked to a report may reveal individuals' identities and breach confidentiality.
Recommendation
Implement authorization checks in the buscarTestigoByIdDenunciaUsuario.php endpoint and verify access rights to witness data.
Other vulnerabilities in CanalDenuncia.app
See all- CVE-2025-41345High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST request with the parameters 'id_denuncia' and 'id_user' to '/backend/api/buscarDenunciasById.php'.
- CVE-2025-41344High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_archivo' parameter to '/backend/api/verArchivo.php'.
- CVE-2025-41343High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'email' parameter to '/backend/api/users/searchUserByEmail.php'.
- CVE-2025-41342High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_user' parameter to '/backend/api/buscarUsuarioId.php'.
- CVE-2025-41341High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_denuncia' and 'seguro' parameters to '/backend/api/buscarUsuarioByDenuncia.php'.
- CVE-2025-41340High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_tp_denuncia' and 'id_sociedad' parameters to '/backend/api/buscarTipoDenunciabyId.php'.
- CVE-2025-41339High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_sociedad' parameter to '/backend/api/buscarTipoDenuncia.php'.
- CVE-2025-41337High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarSSOParametros.php'.
- CVE-2025-41336High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarConfiguracionParametros.php'.
- CVE-2025-41335High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id' and 'id_sociedad' parameters to '/api/buscarEmpresaById.php'.
Original NVD description (English source)
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id_denuncia' and 'id_user' in '/backend/api/buscarTestigoByIdDenunciaUsuario.php'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS