Authorization Bypass in CanalDenuncia.app by CanalDenuncia

CVE-2025-41344

What is CVE-2025-41344?

An authorization bypass vulnerability has been discovered in CanalDenuncia.app, allowing attackers to gain access to sensitive information of other users. The flaw occurs due to improper handling of user permissions when processing POST requests sent through the 'id_archivo' parameter in '/backend/api/verArchivo.php'. This weakness poses a significant risk as it could lead to unauthorized disclosure of personal data, compromising user privacy and security.

References