# CVE-2026-32646: Gardyn Cloud API missing authentication in administrative endpoint

Source: https://junglewise.ai/threats/cve-2026-32646-gardyn-cloud-api-missing-authentication-in-administrative  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-32646 · Severity: high · CVSS 7.5 · Published 2026-04-03

Gardyn Cloud API, which manages smart home hydroponic gardening systems, contains a security flaw where a specific administrative interface is accessible without a password. An unauthorized person could exploit this to access device management functions, potentially allowing them to view plant photos or access limited customer information like names and addresses. Gardyn has released updates to address this issue and reports no evidence of malicious exploitation.

Technologies: [Gardyn Cloud API](https://junglewise.ai/threats/technologies/cloud-api). Vendors: [Gardyn](https://junglewise.ai/threats/vendors/gardyn).

## Quick answers

**Is CVE-2026-32646 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-32646 being exploited in the wild.

**How severe is CVE-2026-32646?** High severity, with a CVSS score of 7.5, published 3 April 2026.

**Which products and versions are affected?** Gardyn Cloud API < 2.12.2026.

**Is there a fix for CVE-2026-32646?** A patch was published on 2026-02-24: Original vendor remediation date Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-32646 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-32646?** Check whether you run Gardyn Cloud API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Gardyn Cloud API (versions prior to 2.12.2026) suffers from a missing authentication vulnerability (CWE-306) in a specific administrative endpoint. This flaw allows a remote, unauthenticated attacker to access sensitive device management functions and retrieve user information, including plant photos and demographic data (name, address, phone number, and email). The vulnerability is reachable over the network without user interaction. Gardyn has remediated the issue in Cloud API version 2.12.2026 and recommends users ensure their mobile app is version 2.11.0 or later and device firmware is version 627 or later.

## Affected products

- Gardyn Cloud API < 2.12.2026

## Timeline

- 2026-02-24: patched: Original vendor remediation date
- 2026-04-03: disclosed: Initial NVD publication
- 2026-07-02: advisory: Latest revision of CISA ICS advisory

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-03.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-055-03.json)
- [https://mygardyn.com/security/](https://mygardyn.com/security/)
- [https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03](https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03)

## Related threats

- [Gardyn IoT Hub hard-coded privileged key exposure](https://junglewise.ai/threats/cve-2026-13768-gardyn-iot-hub-hard-coded-privileged-key-exposure)
- [Gardyn Cloud API Active Debug Code in Development Endpoints](https://junglewise.ai/threats/cve-2026-32662-gardyn-cloud-api-active-debug-code-in-development-endpoints)
- [Gardyn Cloud API missing authentication in administrative notification endpoint](https://junglewise.ai/threats/cve-2026-28767-gardyn-cloud-api-missing-authentication-in-administrative)
- [Gardyn Cloud API missing authentication in user account endpoint](https://junglewise.ai/threats/cve-2026-28766-gardyn-cloud-api-missing-authentication-in-user-account-endpoint)
- [Gardyn Cloud API authorization bypass via ID modification](https://junglewise.ai/threats/cve-2026-25197-gardyn-cloud-api-authorization-bypass-via-id-modification)