Petlibro Smart Pet Feeder Platform through 1.7.31 Broken Access Control via API endpoint

Advisories

severity: medium
date: January 5, 2026
Affecting: Smart Pet Feeder Platform <= 1.7.31
CVE: CVE-2025-3660
CWE: CWE-612 Improper Authorization of Index Containing Sensitive Information
CVSS: 6.9
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References: Security Research: Petlibro: Your Pet Feeder Is Feeding Data To Anyone Who Asks
Credit: bobdahacker
Description: Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains a broken access control vulnerability that allows authenticated users to access other users' pet data by exploiting missing ownership verification. Attackers can send requests to /member/pet/detailV2 with arbitrary pet IDs to retrieve sensitive information including pet details, member IDs, and avatar URLs without proper authorization checks.