PT-2026-1183 · Petlibro · Petlibro Smart Pet Feeder Platform

Bobdahacker · Published 2026-01-03 · Updated 2026-02-03 · CVE-2025-3660

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Petlibro Smart Pet Feeder Platform versions up to 1.7.31

Description An access control issue exists in the Petlibro Smart Pet Feeder Platform that allows authorized users to view data belonging to other users. This occurs because of a lack of proper ownership verification. An attacker can send requests to the /member/pet/detailV2 API endpoint with arbitrary pet IDs to obtain sensitive information, including pet details, member IDs, and avatar URLs, without authorization. The pet ID variable is used in the request to access the data.

Recommendations Versions prior to 1.7.31 should be updated.

Fix

Weakness Enumeration

CWE-612

Related Identifiers

CVE-2025-3660

Affected Products

Petlibro Smart Pet Feeder Platform

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-3660 · Security Note
• https://osv.dev/vulnerability/CVE-2025-3660 · Vendor Advisory
• https://t.me/cveNotify/147649 · Telegram Post
• https://t.me/CVEtracker/41324 · Telegram Post
• https://t.me/cveNotify/150774 · Telegram Post
• https://bobdahacker.com/blog/petlibro · Note
• https://vulncheck.com/advisories/petlibro-smart-pet-feeder-platform-through-broken-access-control-via-api-endpoint · Note
• https://twitter.com/CVEnew/status/2007600720657203534 · Twitter Post