Vulnerability · Published Jan 3, 2026 · Assigned by VulnCheck

CVE-2025-3660Petlibro Smart Pet Feeder Platform through 1.7.31 Broken Access Control via API endpoint

Medium 6.5

In plain English

A medium-severity security flaw in Smart Pet Feeder Platform from Petlibrio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 88.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains a broken access control vulnerability that allows authenticated users to access other users' pet data by exploiting missing ownership verification. Attackers can send requests to /member/pet/detailV2 with arbitrary pet IDs to retrieve sensitive information including pet details, member IDs, and avatar URLs without proper authorization checks.

Affected products (as reported)

Vendor	Product	Versions
Petlibrio	Smart Pet Feeder Platform	0 – through 1.7.31

Weakness: CWE-612 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

Security Research: Petlibro: Your Pet Feeder Is Feeding Data To Anyone Who Asks third-party-advisory, technical-description
VulnCheck Advisory: Petlibro Smart Pet Feeder Platform through 1.7.31 Broken Access Control via API endpoint third-party-advisory