CVE-2025-14317

Vulnerability Description

In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server does not verify the permissions required to obtain the data. This issue was fixed in version 915 (Android) and 7.4.1 (iOS).

Related Weaknesses (CWE)

CWE-359

References

https://cert.pl/posts/2026/01/CVE-2025-14317
https://crazybubble.pl/aplikacja-crazy-bubble/

FAQ

What is CVE-2025-14317?

CVE-2025-14317 is a documented vulnerability. In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server does not verify the permissions requ...

How severe is CVE-2025-14317?

CVSS scoring is not yet available for CVE-2025-14317. Check NVD for updates.

Is there a patch for CVE-2025-14317?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.