CVE-2025-41069CWE-639

CVE-2025-41069

published November 13, 2025

CVSS
5.3
EPSS
0%
Percentile
17.2
In the wild
Unconfirmed
What it is

Insecure Direct Object Reference (IDOR) vulnerability in DeporSite of T-INNOVA. This vulnerability allows an attacker to access or modify unauthorized resources by manipulating requests using the 'idUsuario' parameter in ‘/ajax/TInnova_v2/Formulario_Consentimiento/llamadaAjax/obtenerDatosConsentimientos’, which could lead to the exposure or alteration os confidential data.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00264 · 17.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-11-13T19:15Z
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-references-idor-deporsite-t-innova-deporsite · [email protected]
EPSS history
Timeline
  • 13 NOV 13:23Z
    Insecure Direct Object References (IDOR) in DeporSite of T-Innova DeporSite
    cvelistv5