High · published November 4, 2025
⚡ A sneaky POST request can unlock the personal data of other users on CanalDenuncia.app. Just by tweaking the 'id_denuncia' and 'id_user' parameters, an attacker can access sensitive information! 🔥 Think of it as a nosy hotel guest who finds a way to access other guests' rooms just by asking the front desk for their keys without proper verification. It’s a breach of trust and privacy! This vulnerability means an attacker could potentially expose and misuse private user information, leading to identity theft or harassment. Imagine having your sensitive documents opened up to strangers – it's absolutely devastating for the users involved!
Think of it as a nosy hotel guest who finds a way to access other guests' rooms just by asking the front desk for their keys without proper verification. It’s a breach of trust and privacy! The lack of authorization in this endpoint allows unauthorized access to user data, simply by sending a manipulated POST request with specific parameters. This opens the door for information leakage without any authentication checks in place.
This vulnerability means an attacker could potentially expose and misuse private user information, leading to identity theft or harassment. Imagine having your sensitive documents opened up to strangers – it's absolutely devastating for the users involved! To secure the application, implement strict authorization checks on the '/backend/api/buscarDocumentosByIdDenunciaUsuario.php' endpoint to ensure users can only access their own data. Update the application immediately to close this vulnerability! You’ve got this! Follow these steps, and you’ll be a security hero in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| canaldenuncia/canaldenuncia.app | < 4.4.8 | 4.4.8 |