Cloud Api (Gardyn) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-04-03. Vendor: Gardyn.

CVEs of Cloud Api

• CVE-2026-32646 - CVSS 8.7 (high), 2026-04-03: A specific administrative endpoint is accessible without proper authentication, exposing device management functions.
• CVE-2026-32662 - CVSS 6.9 (medium), 2026-04-03: Development and test API endpoints are present that mirror production functionality.
• CVE-2026-28767 - CVSS 6.9 (medium), 2026-04-03: A specific administrative endpoint notifications is accessible without proper authentication.
• CVE-2026-28766 - CVSS 9.3 (critical), 2026-04-03: A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.
• CVE-2026-25197 - CVSS 9.3 (critical), 2026-04-03: A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.
• CVE-2025-10681 - CVSS 8.8 (high), 2026-04-03: Storage credentials are hardcoded in the mobile app and device firmware. These credentials do not adequately limit end user permissions and do not expire…