CanalDenuncia.app Lack of Authorization Vulnerability Allowing Unauthorized Access to User Information

A lack of authorization vulnerability exists in CanalDenuncia.app versions prior to 4.4.8. This vulnerability enables attackers to access information belonging to other users by sending a POST request with specific parameters. The affected endpoint is '/backend/api/buscarDenunciasById.php', where the 'id_denuncia' and 'id_user' parameters can be manipulated to retrieve unauthorized data.

Impact

Exploitation of this vulnerability allows for unauthorized access to user information, potentially leading to privacy violations or misuse of data.

Remediation

Users can update to CanalDenuncia.app version 4.4.8 to address this vulnerability.