The vulnerability occurs in a Gardyn Cloud API endpoint that allows a user who has already authenticated to alter the identifier field in a request. The user can specify a different user ID, causing the system to process the action on behalf of that other account and bypass the intended authorization checks. This mechanism gives the attacker unauthorized access to personal data and to control of devices tied to the targeted profile, representing a classic privilege escalation through role conflict (CWE‑639).

This weakness affects the Gardyn Cloud API and all components that utilize it, notably the Gardyn mobile application and the Gardyn Home firmware. The fix is included in the latest release of the Gardyn App, and any device firmware before master.622 remains vulnerable. Users should verify that their application and firmware versions are up to date to determine if they are exposed.

The CVSS base score of 9.3 signals a severe risk. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, so the real-world likelihood of exploitation is uncertain. Based on the description, it is inferred that an attacker must first obtain an authenticated session with the Gardyn Cloud, either through credential compromise or social engineering, before being able to craft the API call with a manipulated ID. Once authenticated, the attacker can pivot to other user profiles, potentially gaining full control over the accessed account and its connected devices. The likely attack vector is remote, via the Gardyn Cloud API, and does not require local access to the target device.