CVE-2025-41345: Canaldenuncia.app Auth Bypass Vulnerability

CVE-2025-41345 Overview

A critical authorization bypass vulnerability has been identified in CanalDenuncia.app, a reporting and whistleblower platform. This vulnerability allows unauthenticated attackers to access sensitive user information by manipulating POST request parameters. The flaw exists in the /backend/api/buscarDenunciasById.php endpoint, where insufficient authorization checks permit unauthorized access to other users' complaint data through parameter tampering.

Critical Impact

Attackers can exploit this vulnerability to access confidential user reports and personal information without authentication, potentially exposing sensitive whistleblower data and compromising the integrity of the reporting system.

Affected Products

• CanalDenuncia CanalDenuncia.app (all versions)

Discovery Timeline

• November 4, 2025 - CVE-2025-41345 published to NVD
• November 5, 2025 - Last updated in NVD database

Technical Details for CVE-2025-41345

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), a broken access control flaw that occurs when the application fails to verify whether a user has permission to access a specific resource. In CanalDenuncia.app, the vulnerable endpoint /backend/api/buscarDenunciasById.php processes requests to retrieve complaint records but does not validate that the requesting user has authorization to view the specified records.

The impact of this vulnerability is significant given the nature of the application—a whistleblower and complaint reporting platform. Unauthorized access to complaint data could expose sensitive information about reporters, compromise ongoing investigations, and undermine trust in the confidential reporting system.

Root Cause

The root cause of this vulnerability is the absence of proper authorization checks in the buscarDenunciasById.php API endpoint. The backend code processes the id_denuncia (complaint ID) and id_user (user ID) parameters from incoming POST requests without verifying that the authenticated user has the rights to access the requested records. This allows any user—including unauthenticated attackers—to retrieve arbitrary complaint data by simply guessing or iterating through valid IDs.

Attack Vector

The attack vector involves sending crafted POST requests to the vulnerable API endpoint with manipulated id_denuncia and id_user parameters. Since the endpoint is network-accessible and requires no authentication, an attacker can perform this attack remotely.

An attacker would typically:

1. Identify the vulnerable endpoint at /backend/api/buscarDenunciasById.php
2. Send POST requests with different id_denuncia and id_user values
3. Enumerate valid IDs to retrieve complaint records belonging to other users
4. Extract sensitive information from the returned data

This type of Insecure Direct Object Reference (IDOR) attack is straightforward to execute and can be automated to harvest large amounts of data. For detailed technical information, see the INCIBE CERT Advisory on Multiple Vulnerabilities.

Detection Methods for CVE-2025-41345

Indicators of Compromise

• Unusual volume of POST requests to /backend/api/buscarDenunciasById.php from a single IP address
• Sequential or patterned values in id_denuncia or id_user parameters indicating enumeration attempts
• Access logs showing requests for user IDs that do not match the authenticated session
• Anomalous data exfiltration patterns from the complaint database

Detection Strategies

• Implement web application firewall (WAF) rules to detect parameter tampering and ID enumeration attacks
• Monitor API access logs for unusual patterns of requests to sensitive endpoints
• Deploy runtime application self-protection (RASP) to detect unauthorized data access attempts
• Configure alerting for high-frequency requests to the vulnerable endpoint

Monitoring Recommendations

• Enable detailed logging for all API endpoints handling sensitive data
• Implement rate limiting on the /backend/api/buscarDenunciasById.php endpoint
• Monitor for anomalous user behavior patterns that may indicate data harvesting
• Set up alerts for failed authorization checks once patches are applied

How to Mitigate CVE-2025-41345

Immediate Actions Required

• Restrict access to the /backend/api/buscarDenunciasById.php endpoint at the network level using firewall rules
• Implement IP-based access controls to limit API access to trusted sources
• Deploy a web application firewall (WAF) with rules to block parameter tampering attempts
• Review access logs for evidence of prior exploitation

Patch Information

As of the last update on November 5, 2025, no official vendor patch has been announced. Organizations should monitor the INCIBE CERT Advisory for updates on available fixes. Contact the CanalDenuncia vendor directly for patching guidance and timeline information.

Workarounds

• Implement server-side authorization checks that validate the requesting user owns or has permission to access the requested complaint data
• Add session validation to ensure id_user parameters match the authenticated user's session
• Deploy rate limiting to prevent automated ID enumeration attacks
• Consider temporarily disabling the vulnerable endpoint until proper authorization controls can be implemented

# Example: Nginx rate limiting configuration for the vulnerable endpoint
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/m;

location /backend/api/buscarDenunciasById.php {
    limit_req zone=api_limit burst=5 nodelay;
    # Additional access controls
    allow 10.0.0.0/8;
    deny all;
}