---
id: CVE-2025-41358
title: >-
  Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions
  prior to 25.00.00.12, inclusive
summary: >-
  Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions
  prior to 25.00.00.12, inclusive. This vulnerability could allow an
  authenticated attacker to access other users' documents by manipulating the
  ‘documentCode’ pa…
severity: none
cwe:
  - CWE-639
published: '2025-12-10'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T23:10:00.463'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-41358'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/direct-reference-insecure-objects-idor-cronosweb-cronosweb-i2a
    label: cve-coordination@incibe.es
tags:
  - nvd
epss: 0.00337
epssPercentile: 0.24387
ingestedAt: '2026-09-25T23:21:16.915Z'
---

## Overview

Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated attacker to access other users' documents by manipulating the ‘documentCode’ parameter in '/CronosWeb/Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas'.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.