CVE-2025-41114 — Missing Authorization vulnerability in CanalDenuncia.app

CVE-2025-41114

Missing Authorization vulnerability in CanalDenuncia.app PUBLISHED

Description (CNA)

A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id_denuncia' and 'id_user' in '/backend/api/buscarDocumentosByIdDenunciaUsuario.php'.

Affected (CNA)

Vendor / product	Versions
CanalDenuncia / CanalDenuncia.app	affected 0 before 4.4.8

CWE

CWE-862

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-canaldenunciaapp

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.