Description
In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server does not verify the permissions required to obtain the data. This issue was fixed in version 915 (Android) and 7.4.1 (iOS).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Emaintenance Crazy Bubble Tea
Default version status: unaffected
0 to < 915affected
Emaintenance Crazy Bubble Tea
Default version status: unaffected
0 to < 7.4.1affected