High · published November 4, 2025
⚡ A sneaky lack of authorization lets anyone peek into other users' info at CanalDenuncia.app! Just a simple POST request with the right parameters, and voilà! 🎩 Think of it like leaving your diary open on a café table. Anyone can flip through it if they know where to look, even if they weren’t invited to read it! This vulnerability could lead to unauthorized access to sensitive information of other users, potentially exposing personal data or confidential company details. An attacker could exploit this flaw to gain insights into private interactions or sensitive business operations, leading to trust erosion and regulatory repercussions.
Think of it like leaving your diary open on a café table. Anyone can flip through it if they know where to look, even if they weren’t invited to read it! The flaw exists in the API endpoint '/api/buscarEmpresaById.php', where insufficient checks allow unauthorized users to access information about other users by modifying the 'id' and 'id_sociedad' parameters in a POST request.
This vulnerability could lead to unauthorized access to sensitive information of other users, potentially exposing personal data or confidential company details. An attacker could exploit this flaw to gain insights into private interactions or sensitive business operations, leading to trust erosion and regulatory repercussions. Immediately implement proper authorization checks on the API endpoint to ensure users can only access their own data. Additionally, audit the code for similar vulnerabilities and deploy a patch to the affected version to remediate this issue. You've got this! With these fixes in place, you're on your way to securing CanalDenuncia.app like a pro! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| canaldenuncia/canaldenuncia.app | < 4.4.8 | 4.4.8 |