High · published November 4, 2025
⚡ A sneaky lack of authorization lets attackers peek into other users' data with a simple POST request! 🔍 Think of it like a restaurant where customers can simply ask the server for another table's order without any verification — no password, no questions asked! 🍽️ If exploited, an attacker could access sensitive information belonging to other users, compromising privacy and trust completely. Imagine your personal details on display for anyone to see! That's an absolute nightmare scenario! 💔
Think of it like a restaurant where customers can simply ask the server for another table's order without any verification — no password, no questions asked! 🍽️ This vulnerability arises from insufficient authorization checks when sending a POST request through the 'web' parameter in '/backend/api/buscarConfiguracionParametros2.php', allowing unauthorized access to user information.
If exploited, an attacker could access sensitive information belonging to other users, compromising privacy and trust completely. Imagine your personal details on display for anyone to see! That's an absolute nightmare scenario! 💔 To secure your application, implement strict authorization checks on the mentioned API endpoint immediately. Ensure that only authenticated users can access their own information and test your application for similar vulnerabilities. 🔒 You've got this! With a little attention, you can protect your users and strengthen your app's security! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| canaldenuncia/canaldenuncia.app | < 4.4.8 | 4.4.8 |