CVE-2025-41346 is a critical authorization flaw (CVSS 9.8) in WinPlus v24.11.27 from Informática del Este. An attacker who knows another user numerical ID can impersonate that user. I could not confirm a fixed version, so contact the vendor and limit exposure.
What's affected
The CVE record names WinPlus v24.11.27 from Informática del Este. It says the authorization control is faulty, so that another user can be impersonated by knowing the numerical ID of the account.
Two other CVEs were published on the same day for the same version: CVE-2025-41347, an unrestricted file upload, and CVE-2025-41348, a SQL injection. Together they cover account takeover, code upload and database access in one product.
The advisory page listed in the record was not available to me when I checked, and I could not confirm a fixed version. Ask the vendor or check the INCIBE notice for current remediation.
How to check if you're exposed
Confirm whether WinPlus is deployed and which build runs. The record names v24.11.27. If your build is that one or older, assume it is affected until the vendor says otherwise.
Check whether the WinPlus portal is reachable from the internet. The related CVEs name paths under /WinplusPortal/ws/, which suggests a web service front end, so look at web server logs for that path.
Review account activity. Look for sessions where one login performs actions that do not match that user normal pattern, and for the same user active from two unrelated locations.
What to do now
- Inventory WinPlus installs and their build numbers.
- Ask Informática del Este for a fixed release covering all three CVEs.
- Restrict the portal to trusted networks or a VPN while you wait.
- Review audit logs for account activity that does not fit, and reset credentials for sensitive accounts.
- Apply a web application firewall in front of the portal if you have one.
Why it matters
The record classifies the flaw as CWE-863, incorrect authorization. The system checks that a user is logged in, but not that the action belongs to that user. When the only thing tying a request to an account is a guessable number, anyone can try numbers until they hit an account worth taking.
This CVE is not on the CISA Known Exploited Vulnerabilities list. Numeric IDs are easy to enumerate, which is why identifiers should never be treated as proof of identity. Access checks belong on the server, on every request.
Try it yourself
Three CVEs landed at once for one product. This demo shows how findings are grouped, ranked and tracked to closure.
Click through it at your own pace, or open it full screen.
Quick check
Is a fixed version of WinPlus available?
I could not confirm one. The advisory in the record was not reachable when I checked, so ask the vendor.
Why does a numeric ID matter?
Because the record says knowing the ID is enough to impersonate the user. Numbers are easy to guess in sequence.
Sources
Last reviewed: 18 October 2026.
