PT-2026-2853 · Unknown · Crazy Bubble Tea

Published 2026-01-14 · Updated 2026-01-14 · CVE-2025-14317

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Crazy Bubble Tea versions prior to 915 (Android) Crazy Bubble Tea versions prior to 7.4.1 (iOS)

Description An authenticated attacker can obtain personal information about other users in the Crazy Bubble Tea mobile application. The server does not verify permissions required to access data through the loyaltyGuestId parameter, leading to improper access control.

Recommendations Update to Crazy Bubble Tea version 915 (Android) or later. Update to Crazy Bubble Tea version 7.4.1 (iOS) or later.

Fix

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2025-14317

Affected Products

Crazy Bubble Tea

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-14317 · Security Note
• https://crazybubble.pl/aplikacja-crazy-bubble · Note
• https://cert.pl/posts/2026/01/CVE-2025-14317 · Note
• https://twitter.com/VulmonFeeds/status/2011454496673558869 · Twitter Post
• https://twitter.com/CVEnew/status/2011555224872501257 · Twitter Post