CVE-2025-14317 — User Enumeration in Crazy Bubble Tea mobile application

CVE-2025-14317

User Enumeration in Crazy Bubble Tea mobile application PUBLISHED

Description (CNA)

In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server does not verify the permissions required to obtain the data. This issue was fixed in version 915 (Android) and 7.4.1 (iOS).

Affected (CNA)

Vendor / product	Versions
Emaintenance / Crazy Bubble Tea	affected 0 before 915
Emaintenance / Crazy Bubble Tea	affected 0 before 7.4.1

CWE

CWE-359

References

https://crazybubble.pl/aplikacja-crazy-bubble/
https://cert.pl/posts/2026/01/CVE-2025-14317

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.