CVE-2025-41341: Canaldenuncia.app Auth Bypass Vulnerability

CVE-2025-41341 Overview

CVE-2025-41341 is a missing authorization vulnerability [CWE-862] affecting CanalDenuncia.app, a whistleblower reporting platform. The flaw exists in the /backend/api/buscarUsuarioByDenuncia.php endpoint, which fails to verify a requester's authorization before returning user data. An unauthenticated attacker can send a crafted POST request containing the id_denuncia and seguro parameters to retrieve information belonging to other users of the platform. The vulnerability enables horizontal access to sensitive complaint records without prior authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can read other users' confidential complaint data by manipulating two POST parameters, breaking the confidentiality guarantees of a whistleblower platform.

Affected Products

CanalDenuncia.app (web application)
Endpoint: /backend/api/buscarUsuarioByDenuncia.php
Vendor: canaldenuncia

Discovery Timeline

2025-11-04 - CVE-2025-41341 published to the National Vulnerability Database (NVD)
2025-11-05 - Last updated in NVD database
INCIBE-CERT issued a coordinated security notice covering multiple vulnerabilities in CanalDenuncia.app

Technical Details for CVE-2025-41341

Vulnerability Analysis

The vulnerability is an authorization bypass classified under [CWE-862] Missing Authorization. The affected endpoint /backend/api/buscarUsuarioByDenuncia.php accepts POST requests containing the parameters id_denuncia (complaint identifier) and seguro (a token-like value). The endpoint returns user data associated with the supplied complaint ID without enforcing that the caller is authorized to access that record. Because authorization checks are absent, the network-reachable API can be queried by any remote, unauthenticated client.

The practical impact is confidentiality loss. Whistleblower platforms store identifying details, complaint contents, and metadata that must remain restricted to the reporter and authorized handlers. Exposing this data through an unauthenticated API can compromise reporter anonymity and expose victims to retaliation.

Root Cause

The root cause is the absence of server-side access control on the buscarUsuarioByDenuncia.php endpoint. The application relies on the secrecy or unguessability of the id_denuncia and seguro parameters rather than enforcing a verified session or token-based authorization check tied to the requesting user.

Attack Vector

The attack vector is network-based and requires no authentication, no privileges, and no user interaction. An attacker crafts a POST request to the vulnerable endpoint, supplies values for id_denuncia and seguro, and parses the server response. Enumeration or brute-forcing of identifier values can amplify the data exposure across many complaint records.

No verified proof-of-concept code is publicly available. Technical details are described in the INCIBE Security Notice.

Detection Methods for CVE-2025-41341

Indicators of Compromise

POST requests to /backend/api/buscarUsuarioByDenuncia.php originating from unexpected IP ranges or non-browser user agents.
High-volume or sequentially incrementing values in the id_denuncia parameter, suggesting enumeration.
Requests to the endpoint without a corresponding authenticated session cookie or referer from the legitimate application flow.

Detection Strategies

Inspect web server access logs for POST traffic to buscarUsuarioByDenuncia.php and correlate with session state.
Deploy WAF rules that flag access to the endpoint by clients not associated with an authenticated user context.
Apply rate limiting and anomaly detection on the id_denuncia parameter to surface enumeration patterns.

Monitoring Recommendations

Forward web application and reverse proxy logs to a centralized SIEM for correlation and retention.
Alert on response payload sizes from the affected endpoint that indicate full record disclosure.
Track unique source IPs accessing the endpoint over short time windows.

How to Mitigate CVE-2025-41341

Immediate Actions Required

Restrict network access to /backend/api/buscarUsuarioByDenuncia.php until the vendor delivers a fix, for example via WAF deny rules.
Require an authenticated session and validate that the session principal owns or is authorized for the requested id_denuncia.
Review historical access logs for prior abuse and notify affected reporters where exposure is confirmed.

Patch Information

No vendor patch URL is listed in the NVD record at publication. Refer to the INCIBE Security Notice for vendor coordination details and contact canaldenuncia directly for remediation guidance.

Workarounds

Place the API behind authenticated reverse-proxy access controls until a vendor patch is available.
Implement server-side authorization checks that bind each complaint record to the authenticated user permitted to view it.
Rotate any seguro token values and invalidate predictable identifiers used prior to remediation.

bash

# Example WAF rule (ModSecurity) to block unauthenticated access to the vulnerable endpoint
SecRule REQUEST_URI "@streq /backend/api/buscarUsuarioByDenuncia.php" \
  "id:1004134,phase:1,deny,status:403,\
   chain,msg:'CVE-2025-41341 - block unauthenticated access'"
  SecRule &REQUEST_COOKIES:SESSIONID "@eq 0"