Authorization Flaw in CanalDenuncia.app Exposing User Data

CVE-2025-41336

What is CVE-2025-41336?

An authorization flaw has been identified in CanalDenuncia.app, which enables attackers to exploit the system by accessing unauthorized users' information. This vulnerability arises when an attacker sends a specially crafted POST request through the 'web' parameter in the '/backend/api/buscarConfiguracionParametros.php' endpoint. The resulting unauthorized access can lead to unauthorized data exposure, posing significant risks to user privacy and security.

References