CVE-2025-41341
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_denuncia' and 'seguro' parameters to '/backend/api/buscarUsuarioByDenuncia.php'.
Risk Assessment
The ability to link a report to a user without authorization may reveal reporters' identities and breach report confidentiality.
Recommendation
Add authorization checks to the buscarUsuarioByDenuncia.php endpoint and verify that the requester is entitled to the report data.
Other vulnerabilities in CanalDenuncia.app
See all- CVE-2025-41345High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST request with the parameters 'id_denuncia' and 'id_user' to '/backend/api/buscarDenunciasById.php'.
- CVE-2025-41344High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_archivo' parameter to '/backend/api/verArchivo.php'.
- CVE-2025-41343High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'email' parameter to '/backend/api/users/searchUserByEmail.php'.
- CVE-2025-41342High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_user' parameter to '/backend/api/buscarUsuarioId.php'.
- CVE-2025-41340High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_tp_denuncia' and 'id_sociedad' parameters to '/backend/api/buscarTipoDenunciabyId.php'.
- CVE-2025-41339High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_sociedad' parameter to '/backend/api/buscarTipoDenuncia.php'.
- CVE-2025-41338High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id_denuncia' and 'id_user' parameters to '/backend/api/buscarTestigoByIdDenunciaUsuario.php'.
- CVE-2025-41337High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarSSOParametros.php'.
- CVE-2025-41336High
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'web' in '/backend/api/buscarConfiguracionParametros.php'.
- CVE-2025-41335High
A lack of authorisation vulnerability was detected in CanalDenuncia.app. An attacker can access other users' information by sending a POST request with the 'id' and 'id_sociedad' parameters to '/api/buscarEmpresaById.php'.
Original NVD description (English source)
A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id_denuncia' and 'seguro' in '/backend/api/buscarUsuarioByDenuncia.php'.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS