CanalDenuncia.app Lack of Authorization Vulnerability Allowing Unauthorized Access to User Information

A lack of authorization vulnerability exists in CanalDenuncia.app versions prior to 4.4.8. This vulnerability enables attackers to access information belonging to other users by sending a POST request with specific parameters. The issue arises in the '/backend/api/buscarTestigoByIdDenunciaUsuario.php' endpoint, where the 'id_denuncia' and 'id_user' parameters can be manipulated to retrieve unauthorized data.

Impact

Exploitation of this vulnerability allows for unauthorized access to other users' information.

Remediation

Users can update to CanalDenuncia.app version 4.4.8 to address this vulnerability.