CanalDenuncia.app Lack of Authorization Vulnerability Allowing Unauthorized Access to User Information

A lack of authorization vulnerability exists in CanalDenuncia.app versions prior to 4.4.8. This vulnerability enables attackers to access information belonging to other users by sending a POST request with specific parameters, 'id_denuncia' and 'seguro', to the endpoint '/backend/api/buscarUsuarioByDenuncia.php'.

Impact

Exploitation of this vulnerability allows unauthorized users to access sensitive information of other users, potentially leading to privacy violations or misuse of that information.

Remediation

Users can update to CanalDenuncia.app version 4.4.8 to address this vulnerability.