This vulnerability in the Gardyn Cloud API allows authenticated users to bypass access controls by altering the ID number in an API call, enabling unauthorized access to other users' profiles. It is classified as CWE-639, which involves authorization bypass through improper validation of user-supplied input. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, and no privileges or user interaction required. The vulnerability is published but lacks an official remediation or patch at this time.

An attacker with valid authentication can access or manipulate other users' profiles by modifying the ID parameter in the API request. This can lead to unauthorized disclosure of sensitive user information and potential privacy violations. The critical CVSS score reflects the high impact of this vulnerability on confidentiality and integrity. There are currently no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected API endpoint where possible and monitor for unusual access patterns. Implement additional access control checks at the application layer to prevent unauthorized profile access.