CVE-2026-25197
A flaw in the mygardyn cloud_api lets a logged‑in user change the numeric ID in an API request to view or modify another user’s profile. The issue is a privilege escalation that can expose or alter private data.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
mygardyn cloud_api – users who have authenticated access to the API.
Real-world impact
An attacker who can log in can read or change other users’ information, potentially leaking sensitive data or tampering with accounts.
Why this severity
The CVSS score of 9.3 reflects that the vulnerability has high confidentiality and integrity impact, requires only normal authentication, and can be exploited remotely without special privileges or user interaction.
What to do about it
- ›Verify that the API checks the authenticated user’s ID against the requested profile ID before processing the request.
- ›Restrict API access to trusted users and monitor for unusual ID‑change activity.
- ›Apply the principle of least privilege to limit what authenticated users can do via the API.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Apr 3, 2026 · Apr 3, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- github.com/cisagov/CSAF/blob/develop/c…third party advisory
- mygardyn.com/security/vendor advisory
- cisa.gov/news-events/ics-advisories/…third party advisoryus government resource