Authorization Flaw in CanalDenuncia.app Exposes User Data

CVE-2025-41112

What is CVE-2025-41112?

A security flaw has been identified in CanalDenuncia.app that allows attackers to gain unauthorized access to users' sensitive information. This vulnerability arises from improper authorization controls within the application. By exploiting this flaw, an attacker can send a crafted POST request through the 'web' parameter in the endpoint '/backend/api/buscarConfiguracionParametros2.php', which enables access to the information of other users without permission. Such vulnerabilities pose significant risks to user privacy and data integrity, and users are advised to ensure that they are on secure versions of the application and to monitor for any unusual activities.

References