CVE-2025-3660
Petlibro ≤ 1.7.31
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-3660 is a medium-severity Improper Authorization of Index Containing Sensitive Information (CWE-612) vulnerability in Petlibro Petlibro. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Information Repositories (T1213); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-3660 is a broken access control vulnerability affecting the Petlibro Smart Pet Feeder Platform in versions up to 1.7.31. The flaw stems from missing ownership verification in the /member/pet/detailV2 API endpoint, enabling unauthorized access to other users' pet data. By sending requests with arbitrary pet IDs, attackers can retrieve sensitive information such as pet details, member IDs, and avatar URLs without proper authorization checks. The vulnerability is rated with a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and is associated with CWE-612.
Any authenticated user of the platform can exploit this vulnerability remotely over the network with low complexity. Although the CVSS score indicates no privileges are required (PR:N), the issue specifically allows authenticated attackers to bypass ownership controls and access data belonging to other users. Successful exploitation results in partial confidentiality and integrity impacts, potentially exposing private pet and user information across accounts.
Advisories published by VulnCheck and researcher BobdaHacker provide further details on the vulnerability, including the affected endpoint and exploitation method. Security practitioners should review these resources at https://www.vulncheck.com/advisories/petlibro-smart-pet-feeder-platform-through-broken-access-control-via-api-endpoint and https://bobdahacker.com/blog/petlibro for recommended mitigations, such as updating to a patched version beyond 1.7.31 or implementing server-side ownership checks. The CVE was published on 2026-01-04.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-0785
Vulnerability Data
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains a broken access control vulnerability that allows authenticated users to access other users' pet data by exploiting missing ownership verification. Attackers can send requests to /member/pet/detailV2 with arbitrary pet IDs…
more
to retrieve sensitive information including pet details, member IDs, and avatar URLs without proper authorization checks.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly enforces authorization checks on the search index so that only users permitted to view the original documents can access indexed content.
AC-6 limits privileges so that fewer accounts can reach the index, reducing the chance that unauthorized actors obtain sensitive indexed data.
AC-16 associates sensitivity attributes with data, enabling the index to inherit and enforce the same access restrictions as the source documents.
AC-4 enforces information-flow rules that can stop sensitive data from being reachable through an improperly authorized index.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly enforces authorization policy and least privilege for access to sensitive data including indexes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Information access restriction is the technical mechanism that prevents unauthorized index queries.
Managing access rights ensures only authorized users can reach indexed sensitive content.
Privileged access rights may be used to enforce index restrictions but are not the primary control.
Classification helps identify what must be protected but does not enforce index access limits.
Access control policies directly limit who can query or view the index.
Data leakage prevention can block unauthorized index exposure but is supplementary.