CVE-2025-3574: Deporsite IDOR Information Disclosure Flaw

CVE-2025-3574 Overview

CVE-2025-3574 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Deporsite application from T-INNOVA. The flaw resides in the /helper/Familia/obtenerFamiliaUsuario endpoint, which exposes the idUsuario parameter to client-controlled manipulation. An unauthenticated attacker can iterate or guess user identifiers and retrieve sensitive information belonging to other users. The weakness is tracked under CWE-639: Authorization Bypass Through User-Controlled Key. The Spanish national cybersecurity institute INCIBE coordinated public disclosure of the issue.

Critical Impact
Remote, unauthenticated attackers can enumerate idUsuario values to read personal data belonging to other Deporsite users, resulting in high confidentiality impact.

Affected Products

Deporsite from T-INNOVA (version not specified in the advisory)
Deployments exposing the /helper/Familia/obtenerFamiliaUsuario endpoint
Web-facing instances reachable from untrusted networks

Discovery Timeline

2025-04-15 - CVE-2025-3574 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-3574

Vulnerability Analysis

Deporsite is a sports management web platform developed by T-INNOVA. The application exposes a helper endpoint at /helper/Familia/obtenerFamiliaUsuario that returns family-related information tied to a user. The endpoint accepts an idUsuario parameter that directly references the target user record. The server fails to validate whether the requesting session is authorized to view the supplied identifier. Substituting another user's identifier in the request returns that user's data without further checks. The flaw is exploitable over the network with low attack complexity and requires no privileges or user interaction.

Root Cause

The root cause is missing object-level authorization on a backend handler that trusts a client-supplied primary key. The application maps idUsuario to a database lookup without validating the relationship between the authenticated session and the requested resource. This pattern is the textbook definition of CWE-639, where access decisions depend on a value an attacker fully controls.

Attack Vector

An attacker issues HTTP requests to /helper/Familia/obtenerFamiliaUsuario while varying the idUsuario query parameter. Because user identifiers are typically sequential integers, an attacker can script enumeration to harvest records at scale. The response body discloses information belonging to the targeted account, including data tied to the user's family relationships within the platform. No authentication challenge or per-record permission check interrupts the request.

No public proof-of-concept code is available. See the INCIBE Security Notice for the official advisory.

Detection Methods for CVE-2025-3574

Indicators of Compromise

Repeated HTTP GET or POST requests to /helper/Familia/obtenerFamiliaUsuario from a single source within a short window
Sequential or randomized idUsuario values across consecutive requests from the same client
Large outbound response volumes from the Deporsite application server tied to the helper endpoint
Requests to the endpoint originating from sessions that lack a corresponding authenticated user context

Detection Strategies

Deploy web application firewall (WAF) rules that flag enumeration patterns against /helper/Familia/ paths
Correlate request rate and parameter entropy on the idUsuario parameter through application logs
Alert when a single session or IP requests records for multiple distinct idUsuario values
Compare requested idUsuario values against the authenticated session identifier and flag mismatches

Monitoring Recommendations

Forward Deporsite web server access logs to a centralized analytics platform for parameter-level inspection
Baseline normal request rates per endpoint and trigger anomaly detection on deviations
Retain full request and response metadata for the /helper/Familia/obtenerFamiliaUsuario endpoint to support incident response
Review authentication and authorization decisions emitted by the application for missing checks on helper endpoints

How to Mitigate CVE-2025-3574

Immediate Actions Required

Contact T-INNOVA to confirm the patched build for your Deporsite deployment and apply it once available
Restrict network exposure of the /helper/Familia/obtenerFamiliaUsuario endpoint to authenticated sessions only
Audit access logs for prior enumeration activity against the affected endpoint
Notify users whose data may have been accessed in accordance with applicable data protection regulations

Patch Information

Refer to the INCIBE Security Notice for vendor coordination details. At the time of NVD publication, no fixed version was enumerated in the public advisory. Operators should request remediation guidance directly from T-INNOVA.

Workarounds

Place a reverse proxy or WAF rule in front of Deporsite that enforces a mapping between the session cookie and the permitted idUsuario value
Rate-limit requests to /helper/Familia/obtenerFamiliaUsuario per source IP and per session
Replace sequential numeric identifiers with unguessable random identifiers (UUIDv4) at the application layer where feasible
Disable the affected helper endpoint if it is not required for production functionality

bash

# Example NGINX rate-limit and authentication guard for the affected endpoint
limit_req_zone $binary_remote_addr zone=idor_guard:10m rate=5r/m;

location = /helper/Familia/obtenerFamiliaUsuario {
    limit_req zone=idor_guard burst=2 nodelay;
    if ($cookie_session_id = "") { return 401; }
    proxy_pass http://deporsite_backend;
}