CVE-2025-3660
Published: 04 January 2026
Summary
CVE-2025-3660 is a medium-severity Improper Authorization of Index Containing Sensitive Information (CWE-612) vulnerability in Petlibro Petlibro. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Broken access control in public-facing API endpoint (/member/pet/detailV2) directly enables T1190 for unauthorized data retrieval.
NVD Description
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains a broken access control vulnerability that allows authenticated users to access other users' pet data by exploiting missing ownership verification. Attackers can send requests to /member/pet/detailV2 with arbitrary pet IDs…
more
to retrieve sensitive information including pet details, member IDs, and avatar URLs without proper authorization checks.
Deeper analysisAI
CVE-2025-3660 is a broken access control vulnerability affecting the Petlibro Smart Pet Feeder Platform in versions up to 1.7.31. The flaw stems from missing ownership verification in the /member/pet/detailV2 API endpoint, enabling unauthorized access to other users' pet data. By sending requests with arbitrary pet IDs, attackers can retrieve sensitive information such as pet details, member IDs, and avatar URLs without proper authorization checks. The vulnerability is rated with a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) and is associated with CWE-612.
Any authenticated user of the platform can exploit this vulnerability remotely over the network with low complexity. Although the CVSS score indicates no privileges are required (PR:N), the issue specifically allows authenticated attackers to bypass ownership controls and access data belonging to other users. Successful exploitation results in partial confidentiality and integrity impacts, potentially exposing private pet and user information across accounts.
Advisories published by VulnCheck and researcher BobdaHacker provide further details on the vulnerability, including the affected endpoint and exploitation method. Security practitioners should review these resources at https://www.vulncheck.com/advisories/petlibro-smart-pet-feeder-platform-through-broken-access-control-via-api-endpoint and https://bobdahacker.com/blog/petlibro for recommended mitigations, such as updating to a patched version beyond 1.7.31 or implementing server-side ownership checks. The CVE was published on 2026-01-04.
Details
- CWE(s)