The vulnerability in Kompini Tankuam Places involves improper authorization validation in the password recovery endpoint. Specifically, the '/password/guardarClau/recover' endpoint accepts a user ID parameter without verifying that the JWT token corresponds to the specified user. This lack of validation permits an unauthenticated attacker to reset the password of any user by manipulating the 'usuariId' parameter, potentially compromising administrative accounts and gaining unauthorized access.

An unauthenticated attacker can reset passwords for any user account, including administrative accounts, leading to full account takeover. This can result in unauthorized access to sensitive data and administrative functions within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the password recovery endpoint and monitor for suspicious activity related to password resets.