CVE-2026-28766 describes a critical security flaw in the Gardyn Cloud API where an endpoint returns all registered user account information without enforcing authentication controls. This vulnerability corresponds to CWE-306, indicating missing authentication for a critical function. The issue allows remote attackers to access sensitive user data directly over the network without any privileges or user interaction. The CVSS 4.0 vector highlights high confidentiality impact and low integrity impact. No patch or official remediation guidance is currently available, and the service is not cloud-hosted, so remediation depends on vendor action.

The vulnerability exposes all user account information to unauthenticated remote attackers, potentially leading to privacy breaches and unauthorized data disclosure. Given the critical CVSS score of 9.2, the impact on confidentiality is high. There is no indication of integrity or availability impact. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, organizations using the affected Gardyn Cloud API should monitor vendor communications closely. Until a patch is available, restricting access to the vulnerable endpoint through network controls or API gateways may reduce exposure.