CVE-2026-28767 PUBLISHED

Gardyn Cloud API Missing Authentication for Critical Function

Assigner: icscert
Reserved: 17.03.2026 Published: 03.04.2026 Updated: 03.04.2026

A specific administrative endpoint notifications is accessible without proper authentication.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor Gardyn
Product Cloud API
Versions Default: unaffected
  • affected from 0 to 2.12.2026 (excl.)

Solutions

Gardyn states that the relevant fixes are included in the latest version of the Gardyn mobile application. Users are required to run a supported version of the Gardyn App on their phone in order to access Gardyn services and devices.

The current versions of the Gardyn App and the Gardyn Home firmware can be checked in the Gardyn App.

For all vulnerabilities, Gardyn recommends users ensure their home kit and studio devices are upgraded to firmware master.622 or later. Gardyn also recommends that users update their mobile application to the most recent version. Gardyn requests that users ensure their devices have network connectivity in order to automatically download needed firmware updates. Unconnected devices will automatically update when configured with a working Internet connection.

Credits

  • Michael Groberman reported these vulnerabilities to CISA. finder

References

Problem Types

  • CWE-306 CWE