User Profile Pivoting Vulnerability in Gardyn's API
CVE-2026-25197
9.3CRITICAL
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-25197?
A security flaw exists within the Gardyn API that permits authenticated users to access and modify data related to other user profiles. By manipulating the identifier in API calls, an attacker can gain unintended access to sensitive information, potentially leading to unauthorized data exposure and privacy risks.
Affected Version(s)
Cloud API 0 < 2.12.2026
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved
Credit
Michael Groberman reported these vulnerabilities to CISA.