Medtronic CareLink Network Insecure Direct Object Reference Vulnerability Allowing Exposure of Sensitive User Information

An insecure direct object reference vulnerability exists in the Medtronic CareLink Network, affecting versions prior to December 4, 2025. This vulnerability allows an authenticated attacker with access to specific device and user information to send web requests to an API endpoint that could reveal sensitive user data. The issue is limited to the non-medical portion of the CareLink Network and does not impact CareLink home monitors or app-based monitors.

Impact

Exploitation of this vulnerability could lead to unauthorized exposure of sensitive user information by allowing an attacker to manipulate API requests and access data that should be protected.