CVE-2025-14317 in Crazy Bubble Tea mobile app allows authenticated attackers to enumerate…
CVE-2025-14317 in Crazy Bubble Tea mobile app allows authenticated attackers to enumerate and access other users' personal information via unvalidated loyaltyGuestId parameter.
CERT Polska coordinated the disclosure of CVE-2025-14317, an Insecure Direct Object Reference (IDOR) vulnerability in the Crazy Bubble Tea mobile application developed by Emaintenance. The flaw allows any authenticated user to enumerate the loyaltyGuestId parameter and retrieve personal information belonging to other users. The server fails to validate whether the requesting user has proper authorization to access the requested data.
The vulnerability was responsibly disclosed by researcher Tobiasz "Palidon" Kostrzewa. Emaintenance addressed the issue in version 915 for Android and version 7.4.1 for iOS.
This represents a privacy breach affecting customers of the Crazy Bubble Tea loyalty program. While exploitation requires authenticated access, the enumeration capability could enable mass harvesting of customer personal data. Organizations using customer loyalty applications should verify proper access controls are implemented server-side.
Mentioned in this report
Detection guidance
Sequential Access to Loyalty Guest Profile Parameter (Potential IDOR Enumeration)
Flags API requests to the Crazy Bubble Tea loyalty endpoint referencing the loyaltyGuestId parameter; investigate for a single authenticated session requesting many distinct/sequential loyaltyGuestId values in a short window, which indicates IDOR-based enumeration of other customers' loyalty profiles rather than normal single-account use. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Access to Loyalty Guest ID Parameter Endpoint
id: bafb2dd0-a182-5317-9a35-5bb2d6bebd8d
status: experimental
description: 'Detects HTTP requests to the Crazy Bubble Tea (Emaintenance) loyalty
application API that reference the loyaltyGuestId parameter. This parameter was
subject to an Insecure Direct Object Reference (CVE-2025-14317) allowing any authenticated
user to enumerate other customers'' loyalty profiles. A single request is benign;
this rule is intended as a building block for downstream correlation (e.g. count
of distinct loyaltyGuestId values per source IP/session over a short time window)
that should be implemented in the SIEM''s aggregation layer, since Sigma condition
syntax here cannot express counts.
'
references:
- CVE-2025-14317
author: Vorant
logsource:
category: proxy
product: webserver
detection:
selection:
cs-uri-query|contains: loyaltyGuestId=
filter:
cs-uri-query|contains:
- loyaltyGuestId=self
- loyaltyGuestId=me
condition: selection and not filter
falsepositives:
- Normal in-app requests where a user retrieves their own loyalty profile
- Load testing or QA automation exercising the loyalty API with static test account
IDs
level: low
tags:
- attack.t1087
- attack.discovery
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-14317
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free