High · published November 4, 2025
⚡ A simple POST request could expose private user data! This sneaky vulnerability in CanalDenuncia.app allows unauthorized access to user information. 😱 Think of it like a restaurant where anyone can just stroll into the kitchen and peek at every order — that’s the level of access this vulnerability allows! The chef (server) doesn’t even ask for a reservation before letting someone in. An attacker could exploit this vulnerability to access sensitive information of other users, potentially leading to data breaches and a significant loss of trust. It’s absolutely devastating for users who expect their information to be protected!
Think of it like a restaurant where anyone can just stroll into the kitchen and peek at every order — that’s the level of access this vulnerability allows! The chef (server) doesn’t even ask for a reservation before letting someone in. This vulnerability stems from a lack of proper authorisation checks, allowing attackers to send a POST request through the 'web' parameter in '/backend/api/buscarConfiguracionParametros.php' to access other users' data.
An attacker could exploit this vulnerability to access sensitive information of other users, potentially leading to data breaches and a significant loss of trust. It’s absolutely devastating for users who expect their information to be protected! To fix this issue, immediately implement strong authorisation checks in the relevant API endpoint. Ensure that users can only access their own information and test the application thoroughly post-fix. Patch any vulnerable versions to secure the application! This is fixable! Just follow these steps to protect user data and boost your security muscle! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| canaldenuncia/canaldenuncia.app | < 4.4.8 | 4.4.8 |