In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter.
CVSS 4.0HIGH 7.1·Network·Low privileges·No interaction·EPSS 0.00296·Published 2026-01-14·Fixed in 915, 7.4.1CWE-359