CVE-2026-93556

Tankuam Places by Kompini is affected by an Insecure Direct Object Reference (IDOR) in the /password/guardarClau/recover endpoint. The endpoint accepts a usuariId parameter to specify which account's password to change, but the JWT token used in the recovery process is not validated against that ...