CVE-2025-3660: Petlibro Smart Pet Feeder Platform through 1.7.31 Broken Access Control via API endpoint
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains a broken access control vulnerability that allows authenticated users to access other users' pet data by exploiting missing ownership verification. Attackers can send requests to /member/pet/detailV2 with arbitrary pet IDs to retrieve sensitive information including pet details, member IDs, and avatar URLs without proper authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Petlibro Smart Pet Feeder Platformto a version that resolves this vulnerability.Fixed in 1.7.31 - Compensating control
Restrict access to the API endpoint /member/pet/detailV2 so it enforces proper authorization checks, including verifying the requester owns (or is permitted to access) the pet ID before returning pet details, member IDs, and avatar URLs.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3660?
CVE-2025-3660 is considered a high severity vulnerability due to its potential for unauthorized access to sensitive user data.
How do I fix CVE-2025-3660?
To mitigate CVE-2025-3660, users should upgrade the Petlibro Smart Pet Feeder Platform to version 1.7.32 or later, which addresses the broken access control issue.
Who is affected by CVE-2025-3660?
CVE-2025-3660 affects users of the Petlibro Smart Pet Feeder Platform versions up to 1.7.31.
What type of vulnerability is CVE-2025-3660?
CVE-2025-3660 is classified as a broken access control vulnerability that allows unauthorized access to other users' pet data.
What can attackers do with CVE-2025-3660?
Attackers can exploit CVE-2025-3660 to access and retrieve private pet details of other users by sending crafted API requests.