CVE-2026-25197: Mygardyn Cloud API

High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days.

A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.

Affected products

• Mygardyn Cloud API: before 2.12.2026 (fixed in 2.12.2026)

Published 2026-04-03. Last modified 2026-07-24.