CVE-2025-14317

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14317", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2025-12-09T10:11:51.748Z", "datePublished": "2026-01-14T13:28:02.872Z", "dateUpdated": "2026-01-14T13:57:08.343Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Android"], "product": "Crazy Bubble Tea", "vendor": "Emaintenance", "versions": [{"lessThan": "915", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["iOS"], "product": "Crazy Bubble Tea", "vendor": "Emaintenance", "versions": [{"lessThan": "7.4.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Tobiasz \u201ePalidon\u201d Kostrzewa"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>In Crazy Bubble Tea <span style=\"background-color: rgb(255, 255, 255);\">mobile application</span> authenticated attacker can&nbsp;obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server&nbsp;does not verify the permissions required to obtain the data.<br></p><p>This issue was fixed in version&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">915 (Android) and 7.4.1 (iOS).</span></p>"}], "value": "In Crazy Bubble Tea mobile application authenticated attacker can\u00a0obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server\u00a0does not verify the permissions required to obtain the data.\n\n\nThis issue was fixed in version\u00a0915 (Android) and 7.4.1 (iOS)."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 7.1, "baseSeverity": "HIGH", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-359", "description": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-01-14T13:28:02.872Z"}, "references": [{"tags": ["product"], "url": "https://crazybubble.pl/aplikacja-crazy-bubble/"}, {"tags": ["third-party-advisory"], "url": "https://cert.pl/posts/2026/01/CVE-2025-14317"}], "source": {"discovery": "EXTERNAL"}, "title": "User Enumeration in Crazy Bubble Tea mobile application", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-14T13:56:54.473704Z", "id": "CVE-2025-14317", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T13:57:08.343Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14317", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-14T13:56:54.473704Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-14T13:57:04.650Z"}}], "cna": {"title": "User Enumeration in Crazy Bubble Tea mobile application", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Tobiasz \u201ePalidon\u201d Kostrzewa"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Emaintenance", "product": "Crazy Bubble Tea", "versions": [{"status": "affected", "version": "0", "lessThan": "915", "versionType": "custom"}], "platforms": ["Android"], "defaultStatus": "unaffected"}, {"vendor": "Emaintenance", "product": "Crazy Bubble Tea", "versions": [{"status": "affected", "version": "0", "lessThan": "7.4.1", "versionType": "semver"}], "platforms": ["iOS"], "defaultStatus": "unaffected"}], "references": [{"url": "https://crazybubble.pl/aplikacja-crazy-bubble/", "tags": ["product"]}, {"url": "https://cert.pl/posts/2026/01/CVE-2025-14317", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In Crazy Bubble Tea mobile application authenticated attacker can\u00a0obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server\u00a0does not verify the permissions required to obtain the data.\n\n\nThis issue was fixed in version\u00a0915 (Android) and 7.4.1 (iOS).", "supportingMedia": [{"type": "text/html", "value": "<p>In Crazy Bubble Tea <span style=\"background-color: rgb(255, 255, 255);\">mobile application</span> authenticated attacker can&nbsp;obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server&nbsp;does not verify the permissions required to obtain the data.<br></p><p>This issue was fixed in version&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">915 (Android) and 7.4.1 (iOS).</span></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-359", "description": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-01-14T13:28:02.872Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14317", "state": "PUBLISHED", "dateUpdated": "2026-01-14T13:57:08.343Z", "dateReserved": "2025-12-09T10:11:51.748Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-01-14T13:28:02.872Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Android"], "product": "Crazy Bubble Tea", "vendor": "Emaintenance", "versions": [{"lessThan": "915", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["iOS"], "product": "Crazy Bubble Tea", "vendor": "Emaintenance", "versions": [{"lessThan": "7.4.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Crazy Bubble Tea mobile application authenticated attacker can\u00a0obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server\u00a0does not verify the permissions required to obtain the data.\n\n\nThis issue was fixed in version\u00a0915 (Android) and 7.4.1 (iOS)."}, {"lang": "es", "value": "En la aplicaci\u00f3n m\u00f3vil Crazy Bubble Tea, un atacante autenticado puede obtener informaci\u00f3n personal sobre otros usuarios al enumerar un par\u00e1metro 'loyaltyGuestId'. El servidor no verifica los permisos necesarios para obtener los datos.\n\nEste problema se solucion\u00f3 en la versi\u00f3n 915 (Android) y 7.4.1 (iOS)."}], "id": "CVE-2025-14317", "lastModified": "2026-06-17T08:35:43.480", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14317", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-14T13:56:54.473704Z", "version": "2.0.3"}}]}, "published": "2026-01-14T14:16:11.543", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/posts/2026/01/CVE-2025-14317"}, {"source": "cvd@cert.pl", "url": "https://crazybubble.pl/aplikacja-crazy-bubble/"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-359"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"created": "2026-01-15T08:03:28.481140+00:00", "updated": "2026-01-15T08:03:28.481167+00:00", "vendors": ["emaintenance", "emaintenance$PRODUCT$crazy_bubble_tea"]}