CVE-2025-3646 is an authorization bypass vulnerability in the Petlibro Smart Pet Feeder Platform affecting versions up to 1.7.31. The vulnerability arises from missing authentication checks on critical functions within the device share API, allowing unauthenticated attackers to add users as shared owners to devices. This bypass enables unauthorized access to devices and exposure of owner information without valid permission validation. The CVSS 4.0 base score is 6.9, indicating a medium severity level with network attack vector and no required privileges or user interaction.

Exploitation of this vulnerability allows attackers to gain unauthorized access to smart pet feeder devices by adding themselves as shared owners. This unauthorized access can lead to exposure of owner information and potential control over the device without authentication. The impact is limited to confidentiality and authorization bypass but does not include system compromise or denial of service based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the device share API where possible and monitor for unauthorized sharing activity. Avoid exposing the device management interfaces to untrusted networks.