# CVE-2026-28767: Gardyn Cloud API missing authentication in administrative notification endpoint

Source: https://junglewise.ai/threats/cve-2026-28767-gardyn-cloud-api-missing-authentication-in-administrative  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-28767 · Severity: medium · CVSS 5.3 · Published 2026-04-03

Gardyn Cloud API, which manages smart indoor gardening systems, contains a security flaw where a specific administrative notification endpoint is accessible without authentication. This could allow an unauthorized person to access system notifications or potentially sensitive operational data. While there is no evidence of active exploitation, such a flaw could impact customer privacy or provide insights into system operations.

Technologies: [Gardyn Cloud API](https://junglewise.ai/threats/technologies/cloud-api). Vendors: [Gardyn](https://junglewise.ai/threats/vendors/gardyn).

## Quick answers

**Is CVE-2026-28767 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-28767 being exploited in the wild.

**How severe is CVE-2026-28767?** Medium severity, with a CVSS score of 5.3, published 3 April 2026.

**Which products and versions are affected?** Gardyn Cloud API before 2.12.2026.

**Is there a fix for CVE-2026-28767?** A patch was published on 2026-02-24: Initial vendor remediation and internal disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-28767 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-28767?** Check whether you run Gardyn Cloud API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Gardyn Cloud API suffers from a missing authentication vulnerability (CWE-306) within a specific administrative endpoint used for notifications. An unauthenticated attacker can reach this endpoint over the network without providing valid credentials. Successful exploitation allows the attacker to access information handled by this administrative notification service. The vulnerability was addressed in Cloud API version 2.12.2026. This issue was part of a broader set of vulnerabilities affecting the Gardyn ecosystem, including the Home and Studio firmware and mobile applications.

## Affected products

- Gardyn Cloud API before 2.12.2026

## Timeline

- 2026-02-24: patched: Initial vendor remediation and internal disclosure
- 2026-04-03: disclosed: Initial NVD publication and ICS-CERT advisory
- 2026-07-02: advisory: Last revision of the CISA ICS advisory

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-03.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-03.json)
- [https://mygardyn.com/security/](https://mygardyn.com/security/)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03](https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03)

## Related threats

- [Gardyn IoT Hub hard-coded privileged key exposure](https://junglewise.ai/threats/cve-2026-13768-gardyn-iot-hub-hard-coded-privileged-key-exposure)
- [Gardyn Cloud API Active Debug Code in Development Endpoints](https://junglewise.ai/threats/cve-2026-32662-gardyn-cloud-api-active-debug-code-in-development-endpoints)
- [Gardyn Cloud API missing authentication in administrative endpoint](https://junglewise.ai/threats/cve-2026-32646-gardyn-cloud-api-missing-authentication-in-administrative)
- [Gardyn Cloud API missing authentication in user account endpoint](https://junglewise.ai/threats/cve-2026-28766-gardyn-cloud-api-missing-authentication-in-user-account-endpoint)
- [Gardyn Cloud API authorization bypass via ID modification](https://junglewise.ai/threats/cve-2026-25197-gardyn-cloud-api-authorization-bypass-via-id-modification)