Hedera Guardian EUVD-2026-30494

The vulnerability requires only network access to the API Gateway's /api/v1/demo/registered-users endpoint; no authentication credentials, special configuration, or user interaction is required for exploitation. The endpoint is vulnerable in its default configuration when the @Auth decorator is absent (versions through 3.5.1). Access is limited only by network connectivity to the Guardian instance-there is no API rate limiting, request validation, or credential requirement documented as a control. Once the @Auth(Permissions.DEMO_KEY_CREATE) decorator is applied (in patched versions), the endpoint becomes protected and requires valid authentication tokens with the specified permission, eliminating the bypass.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms network-accessible remote exploitation requiring no authentication, elevated privileges, or user interaction, which typically indicates high real-world risk. However, the confidentiality impact is rated as 'Low' (C:L), suggesting the disclosed information alone does not directly enable system compromise - it reveals user metadata rather than credentials or tokens. The CVSS score of 5.3 places this in the medium range and reflects this limited direct impact. No EPSS score, KEV listing, or POC availability is documented in the provided data, preventing assessment of actual exploitation likelihood in the wild. The upstream fix in PR #6076, which adds explicit authentication enforcement, confirms this was a genuine bypass rather than a documentation error. For organizations running Guardian in production with user-sensitive deployments (e.g., supply chain governance, regulatory systems), this represents a clear data leakage risk warranting priority patching; for development-only or isolated instances, the risk is lower but still notable given ease of exploitation.

An attacker with network access to the Hedera Guardian API Gateway sends an unauthenticated GET request to /api/v1/demo/registered-users without providing an authentication token. The endpoint, lacking authentication checks in vulnerable versions, returns a JSON array containing usernames, DIDs, system roles, and policy assignments for all registered users in the system. The attacker can harvest this user directory and potentially correlate it with other intelligence to identify high-value accounts, phishing targets, or targets for privilege escalation attacks.