High · published November 4, 2025
⚡ A simple POST request can let an attacker peek into others' private info! This lack of authorization in CanalDenuncia.app is like leaving your diary open on a park bench. 📖 Think of it as someone walking into a crowded room and announcing your secrets to everyone present. Instead of protecting individual privacy, this vulnerability allows unauthorized access to data by simply altering one parameter in a request. An attacker could gain access to sensitive information from other users, which is absolutely devastating! With just a bit of clever manipulation, they could expose personal data that was meant to be private and confidential.
Think of it as someone walking into a crowded room and announcing your secrets to everyone present. Instead of protecting individual privacy, this vulnerability allows unauthorized access to data by simply altering one parameter in a request. This vulnerability occurs because the application does not properly verify authorization when accessing user information through the 'id_denuncia' parameter in the API endpoint '/backend/api/buscarDenunciaByPin.php'.
An attacker could gain access to sensitive information from other users, which is absolutely devastating! With just a bit of clever manipulation, they could expose personal data that was meant to be private and confidential. To mitigate this, ensure that proper authorization checks are implemented before granting access to user data based on the 'id_denuncia' parameter. Additionally, review access controls and update to the latest patched version of CanalDenuncia.app. You've got this! Implement these changes, and you'll enhance user privacy in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| canaldenuncia/canaldenuncia.app | < 4.4.8 | 4.4.8 |