High · published November 4, 2025
⚡ An authorization oversight lets attackers sneak a peek at other users' data—sending a crafty POST request is all it takes! 🚨 Think of it as a restaurant where customers can peek at each other’s bills without any checks in place. If someone just walks up to the counter and asks, they might get to see all the juicy details about what everyone ordered! An attacker can easily access sensitive information from other users, leading to privacy breaches and potentially exposing personal data like social details and complaint information. This could be absolutely devastating for users who trust the app to keep their information safe.
Think of it as a restaurant where customers can peek at each other’s bills without any checks in place. If someone just walks up to the counter and asks, they might get to see all the juicy details about what everyone ordered! This vulnerability arises from a lack of proper authorization checks when accessing the API endpoint 'buscarTipoDenunciabyId.php'. An attacker can exploit this by manipulating the 'id_tp_denuncia' and 'id_sociedad' parameters in a POST request to retrieve unauthorized user information.
An attacker can easily access sensitive information from other users, leading to privacy breaches and potentially exposing personal data like social details and complaint information. This could be absolutely devastating for users who trust the app to keep their information safe. To remediate this vulnerability, implement robust authorization checks on the API endpoint to ensure users can only access their own data based on their session credentials. It’s vital to patch to the latest version and conduct regular security audits of your application's API endpoints. You've got this! With these changes, you can lock down your application and keep your users' data safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| canaldenuncia/canaldenuncia.app | < 4.4.8 | 4.4.8 |