CVE-2025-41338: Canaldenuncia Canaldenuncia.app

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameters 'id_denuncia' and 'id_user' in '/backend/api/buscarTestigoByIdDenunciaUsuario.php'.

Affected products

• Canaldenuncia Canaldenuncia.app: before 4.4.8 (fixed in 4.4.8)

Published 2025-11-04. Last modified 2026-06-17.