CVE-2025-3660
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A broken access control vulnerability in Petlibro Smart Pet Feeder Platform up to version 1.7.31 allows authenticated users to access other users' pet data by exploiting missing ownership verification. Attackers can send requests to /member/pet/detailV2 with arbitrary pet IDs to retrieve sensitive information.
Risk Assessment
The risk involves unauthorized disclosure of pet details, member IDs, and avatar URLs, potentially compromising user privacy and enabling further attacks.
Recommendation
Immediately update Petlibro Smart Pet Feeder Platform to the latest version and implement ownership verification mechanisms for all API endpoints.
Original NVD description (English source)
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains a broken access control vulnerability that allows authenticated users to access other users' pet data by exploiting missing ownership verification. Attackers can send requests to /member/pet/detailV2 with arbitrary pet IDs to retrieve sensitive information including pet details, member IDs, and avatar URLs without proper authorization checks.