Security Advisory

CVE-2025-14317

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-01-14 13:28:02

Last updated 2026-01-14 13:57:08

Assigner CERT-PL

State PUBLISHED

Description

In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server does not verify the permissions required to obtain the data. This issue was fixed in version 915 (Android) and 7.4.1 (iOS).

← Browse all CVEs View on cve.org ↗