Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-25197

Gardyn Cloud API Authorization Bypass Through User-Controlled Key

Description

A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Gardyn Cloud API

Default version status: unaffected

  • 0 to < 2.12.2026affected

References