Authorization Flaw in CanalDenuncia.app by Canal Denuncia

CVE-2025-41114

What is CVE-2025-41114?

A vulnerability in CanalDenuncia.app allows for unauthorized access to user information, enabling attackers to exploit the API by manipulating parameters in a POST request. This weakness jeopardizes the confidentiality of user data, as attackers can potentially access sensitive documents associated with other users by specifying 'id_denuncia' and 'id_user' in the '/backend/api/buscarDocumentosByIdDenunciaUsuario.php' endpoint. Proper validation and authorization checks are essential to safeguard user information against such exploits.

References