CVE-2025-3660 describes an improper authorization vulnerability in Petlibro Smart Pet Feeder Platform (<=1.7.31). Authenticated users can exploit missing ownership verification in the /member/pet/detailV2 API endpoint to access sensitive pet data belonging to other users. The flaw allows retrieval of pet details, member identifiers, and avatar URLs without proper access control enforcement. This vulnerability is classified as medium severity with a CVSS 4.0 base score of 6.9, reflecting network attack vector, low complexity, and limited impact on confidentiality and integrity.

The vulnerability enables unauthorized disclosure of sensitive pet-related information and user identifiers to authenticated attackers. While it does not allow privilege escalation or system compromise, it compromises user privacy by exposing personal pet data and member IDs. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected API endpoint and monitor for suspicious activity involving arbitrary pet ID requests. Implementing proper ownership verification on the server side is necessary to remediate this issue.