CVE-2026-25197: Authorization Bypass via User-Controlled Key (IDOR)

Advisory

Product

Summary

Two REST API endpoints return user data without per-user authorization checks:

• /api/users returns the full user list. No authentication is required.
• /api/user/{id} returns the profile of the user identified by {id}. No verification is performed that the requesting party is authorized to access that user's record.

User identifiers are sequential integers, allowing enumeration of all 134,215+ user accounts and their associated devices via the /api/user/{id} endpoint.

Vulnerability Details

Unauthenticated User Listing

The /api/users endpoint accepts unauthenticated requests and returns the complete user list. No authentication, rate limiting, or access logging is performed on this endpoint.

GET [REDACTED — Cloud API host]/api/users
Authentication: NONE

User Profile Endpoint — IDOR

The /api/user/{id} endpoint accepts a user ID as a path parameter and returns the corresponding user's profile. The endpoint performs no authorization check to verify that the requesting party is associated with the requested user. User IDs are sequential integers.

GET [REDACTED — Cloud API host]/api/user/{user_id}

Data exposed per user:

Predictable Camera Image URLs

Camera image URLs follow a predictable pattern incorporating the sequential user ID, device ID, and timestamp. Once user and device IDs are obtained via the IDOR, an attacker can construct valid URLs to access any user's camera images without additional authentication. The Gardyn camera captures still images only — no audio streams are recorded or exposed.

Impact

• PII exposure for 134,215+ users via sequential enumeration
• Access to home interior camera images from approximately 115,000 Gardyn cameras
• Complete user-to-device mapping enabling targeted attacks
• Two independent vectors: /api/users (no auth, full user list) and /api/user/{id} (sequential IDOR, any user's data)
• Privacy violation at scale -- names, emails, physical addresses, device data, camera images

Azure Services Available for This Class of Endpoint

Remediation

Gardyn recommends upgrading to Cloud API version 2.12.2026 or later. See https://mygardyn.com/security/ for additional information.

Recommended mitigations for device owners:

• Isolate the Gardyn device on a dedicated VLAN or IoT network segment
• Consider whether the built-in camera captures sensitive areas of your home

Recommended fix for the vendor:

1. Implement proper authorization checks on all user and device data endpoints
2. Replace sequential integer IDs with non-enumerable identifiers (UUIDs)
3. Validate that the authenticated user owns the requested resource before returning data
4. Rotate API credentials and remove from Firebase Remote Config
5. Implement rate limiting on user/device lookup endpoints
6. Audit access logs for enumeration patterns

Timeline

References

• CVE-2026-25197 -- CVE Record
• ICSA-26-055-03
• CWE-639: Authorization Bypass Through User-Controlled Key

Credit

Reported by Michael Groberman — Gr0m to CISA.