# CVE-2026-25197: Gardyn Cloud API authorization bypass via ID modification

Source: https://junglewise.ai/threats/cve-2026-25197-gardyn-cloud-api-authorization-bypass-via-id-modification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-25197 · Severity: critical · CVSS 9.1 · Published 2026-04-03

Gardyn Cloud API, which manages smart indoor gardening systems, contains a security flaw that allows users to access other customers' profiles. By simply changing an ID number in a web request, an attacker could view private information such as names, addresses, and plant photos, or potentially interfere with the watering and lighting schedules of other users' devices. This issue has been addressed in recent updates to the Gardyn mobile app and device firmware.

Technologies: [Gardyn Cloud API](https://junglewise.ai/threats/technologies/cloud-api). Vendors: [Gardyn](https://junglewise.ai/threats/vendors/gardyn).

## Quick answers

**Is CVE-2026-25197 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25197 being exploited in the wild.

**How severe is CVE-2026-25197?** Critical severity, with a CVSS score of 9.1, published 3 April 2026.

**Which products and versions are affected?** Gardyn Cloud API < 2.12.2026.

**Is there a fix for CVE-2026-25197?** A patch was published on 2026-02-24: Original vendor remediation date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25197 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-25197?** Check whether you run Gardyn Cloud API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Gardyn Cloud API is vulnerable to an Authorization Bypass Through User-Controlled Key (CWE-639), commonly known as Insecure Direct Object Reference (IDOR). A specific API endpoint fails to properly validate that the authenticated user has permission to access the requested resource ID. By modifying the 'id' number in an API call, a remote attacker can pivot to other user profiles. This can lead to the exposure of sensitive demographic information (names, addresses, phone numbers), access to plant photos, and potential remote control of Gardyn Home and Studio devices. The vulnerability is fixed in Cloud API version 2.12.2026, which corresponds with Gardyn Mobile App version 2.11.0 and device firmware version 627.

## Affected products

- Gardyn Cloud API < 2.12.2026

## Timeline

- 2026-02-24: patched: Original vendor remediation date
- 2026-04-03: disclosed: Initial NVD publication
- 2026-07-02: advisory: Latest revision of CISA/ICS-CERT advisory

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-03.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-03.json)
- [https://mygardyn.com/security/](https://mygardyn.com/security/)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03](https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03)

## Related threats

- [Gardyn IoT Hub hard-coded privileged key exposure](https://junglewise.ai/threats/cve-2026-13768-gardyn-iot-hub-hard-coded-privileged-key-exposure)
- [Gardyn Cloud API Active Debug Code in Development Endpoints](https://junglewise.ai/threats/cve-2026-32662-gardyn-cloud-api-active-debug-code-in-development-endpoints)
- [Gardyn Cloud API missing authentication in administrative endpoint](https://junglewise.ai/threats/cve-2026-32646-gardyn-cloud-api-missing-authentication-in-administrative)
- [Gardyn Cloud API missing authentication in administrative notification endpoint](https://junglewise.ai/threats/cve-2026-28767-gardyn-cloud-api-missing-authentication-in-administrative)
- [Gardyn Cloud API missing authentication in user account endpoint](https://junglewise.ai/threats/cve-2026-28766-gardyn-cloud-api-missing-authentication-in-user-account-endpoint)