CVE-2026-93556: Direct references to unsafe objects (IDOR) in Tankuam Places by Kompini
The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated attacker could manipulate the identifier and reset the password for any account, including administrative accounts, which could allow them to take control of the account.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited by an unauthenticated attacker. They can alter the usuariId parameter during the password-recovery process to target another account.
Which accounts could be affected?
Any account whose identifier can be supplied to the endpoint may be affected, including administrative accounts. Successful exploitation could let an attacker take control of the targeted account.
How can defenders determine whether an account may have been compromised?
Review password-recovery and password-change activity for the /password/guardarClau/recover endpoint, particularly requests where the usuariId does not correspond to the account associated with the recovery JWT. Investigate unexpected password resets, especially for administrative accounts.