CVE-2026-25197 CRITICAL

CVE-2026-25197: Gardyn Cloud API Authorization Bypass Through User-Controlled Key

Vendor Gardyn
Product Cloud API
Weakness CWE-639 · IDOR
Published April 3, 2026
Last update April 7, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.

Key dates

02Disclosure timeline

April 3, 2026 CVE published
April 7, 2026 Record updated