There is little security risk in using the method you described for confirming an email address of new accounts, but that's because there is little security risk in general in an invalid email address getting validated. Even if you used a much easier to guess ID than GUIDs, not too much can go badly (from a security point of view) if someone pulls one over on you and signs up with a fake email address, or with someone else's email address.
That being said, I don't think that is the essence of your question. As Anders brushed upon in his comment- is any sensitive information accessible if someone could successfully guess a GUID? Probably not for account creation, but if you use the same type of URL for password resets, then we have more to talk about from a security point of view, as then we can assess the security of the GUID itself.
GUIDs, as their name suggests, are globally unique, and thus you don't have to worry about collisions. They are also 128 bit which makes them difficult to predict. (Note though that some of the bits are reserved so you don't quite have 128 bits of entropy.) That being said, they are generally not impossible to predict, because they usually are generated based on a particular timestamp. If that timestamp is known (or figured out somehow), the number of attempts needed to successfully brute force and find a valid GUID in use is feasible to conquer with modern equipment. This can be mitigated by using short lived expiring GUIDs for sensitive actions such as password resets, but if you're dealing with high security information contained within a user account, then you're probably best off using something other than GUIDs such as a cryptographically secure randomly generated string.