CVE-2026-25197 describes an authorization bypass vulnerability in the Gardyn Cloud API. Authenticated users can pivot to other user profiles by modifying the ID number in a specific API call, violating proper access control. This issue is categorized as CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability has a CVSS 4.0 base score of 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. No official patch or remediation guidance is currently available, and the affected product is not a cloud service. No known exploitation has been reported.

Successful exploitation allows an authenticated user to access or manipulate other users' profiles by altering the user ID parameter in API requests. This can lead to unauthorized disclosure or modification of sensitive user data, severely impacting confidentiality and integrity. The CVSS score of 9.3 indicates critical severity with high impact on data confidentiality and integrity. There is no indication of availability impact. No known exploits have been observed in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should restrict access to the affected API endpoints to trusted users only and monitor for unusual API usage patterns. Since no official remediation or temporary fix is provided, organizations should follow vendor updates closely and apply patches once available.