CVE-2025-3660
Medium · 6.5CVSS
6.5
EPSS
0.2%
Published
Jan 4, 2026
CISA due date
—
The record
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains a broken access control vulnerability that allows authenticated users to access other users' pet data by exploiting missing ownership verification. Attackers can send requests to /member/pet/detailV2 with arbitrary pet IDs to retrieve sensitive information including pet details, member IDs, and avatar URLs without proper authorization checks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2019-25605 EquityPandit 1.0 contains an insecure logging vulnerability that allows attackers to… CWE-612
- CVE-2025-3654 Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information… CWE-612
- CVE-2025-3653 Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper access… CWE-612