# CVE-2025-14317 in Crazy Bubble Tea mobile app allows authenticated attackers to enumerate…

Published: 2026-01-14 · Severity: medium · Sectors: retail
Canonical: https://vorant.io/reports/a512636a-9c64-4979-adca-e28c60cfcaf2/cve-2025-14317-in-crazy-bubble-tea-mobile-app-allows-authenticated-attackers-to

> CVE-2025-14317 in Crazy Bubble Tea mobile app allows authenticated attackers to enumerate and access other users' personal information via unvalidated loyaltyGuestId parameter.

CERT Polska coordinated the disclosure of CVE-2025-14317, an Insecure Direct Object Reference (IDOR) vulnerability in the Crazy Bubble Tea mobile application developed by Emaintenance. The flaw allows any authenticated user to enumerate the loyaltyGuestId parameter and retrieve personal information belonging to other users. The server fails to validate whether the requesting user has proper authorization to access the requested data.

The vulnerability was responsibly disclosed by researcher Tobiasz "Palidon" Kostrzewa. Emaintenance addressed the issue in version 915 for Android and version 7.4.1 for iOS.

This represents a privacy breach affecting customers of the Crazy Bubble Tea loyalty program. While exploitation requires authenticated access, the enumeration capability could enable mass harvesting of customer personal data. Organizations using customer loyalty applications should verify proper access controls are implemented server-side.

## Mentioned in this report

- Vulnerabilities: CVE-2025-14317

## Detection guidance (public sample)

### Sequential Access to Loyalty Guest Profile Parameter (Potential IDOR Enumeration)

ATT&CK: T1087

Flags API requests to the Crazy Bubble Tea loyalty endpoint referencing the loyaltyGuestId parameter; investigate for a single authenticated session requesting many distinct/sequential loyaltyGuestId values in a short window, which indicates IDOR-based enumeration of other customers' loyalty profiles rather than normal single-account use. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Access to Loyalty Guest ID Parameter Endpoint
id: bafb2dd0-a182-5317-9a35-5bb2d6bebd8d
status: experimental
description: 'Detects HTTP requests to the Crazy Bubble Tea (Emaintenance) loyalty
  application API that reference the loyaltyGuestId parameter. This parameter was
  subject to an Insecure Direct Object Reference (CVE-2025-14317) allowing any authenticated
  user to enumerate other customers'' loyalty profiles. A single request is benign;
  this rule is intended as a building block for downstream correlation (e.g. count
  of distinct loyaltyGuestId values per source IP/session over a short time window)
  that should be implemented in the SIEM''s aggregation layer, since Sigma condition
  syntax here cannot express counts.

  '
references:
- CVE-2025-14317
author: Vorant
logsource:
  category: proxy
  product: webserver
detection:
  selection:
    cs-uri-query|contains: loyaltyGuestId=
  filter:
    cs-uri-query|contains:
    - loyaltyGuestId=self
    - loyaltyGuestId=me
  condition: selection and not filter
falsepositives:
- Normal in-app requests where a user retrieves their own loyalty profile
- Load testing or QA automation exercising the loyalty API with static test account
  IDs
level: low
tags:
- attack.t1087
- attack.discovery
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/01/CVE-2025-14317

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a512636a-9c64-4979-adca-e28c60cfcaf2/cve-2025-14317-in-crazy-bubble-tea-mobile-app-allows-authenticated-attackers-to.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup