The /password/guardarClau/recover endpoint accepts an usuariId parameter that identifies the account whose password is to be changed. The JWT token issued for the recovery process is not validated against this user ID. An attacker who can forge or guess a token can manipulate the usuariId value and reset the password for any account, including privileged ones, allowing full control of the targeted account. This flaw directly supports unauthorized privilege escalation and violates the principle that tokens must bind to the intended user, as defined by CWE-639.

The vulnerability exists in Kompini’s Tankuam Places application. No specific version numbers are disclosed in the report, so all released iterations of Tankuam Places are considered potentially affected until the vendor’s fix is applied.

The CVSS score of 9.3 indicates a critical severity. The EPSS score is not available, but the vulnerability is exploitable by an unauthenticated attacker with minimal skill who can send a crafted request to the password reset endpoint. The attack can be performed remotely and does not require prior system access or advanced configuration. The vulnerability is not listed in CISA’s KEV catalog, but its high CVSS and straightforward exploitation path warrant immediate remediation.