Description
In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server does not verify the permissions required to obtain the data.
This issue was fixed in version 915 (Android) and 7.4.1 (iOS).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Emaintenance | Crazy Bubble Tea | < 915, < 7.4.1 | 915 |
References
- https://crazybubble.pl/aplikacja-crazy-bubble/ product
- https://cert.pl/posts/2026/01/CVE-2025-14317 third-party-advisory