CVE-2026-28767 describes a vulnerability in the Gardyn Cloud API where the administrative 'notifications' endpoint does not enforce authentication, allowing unauthenticated users to access it. This is classified under CWE-306, indicating missing authentication for a critical function. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality. No official patch or remediation level has been provided by the vendor, and the service is not cloud-hosted, so remediation responsibility lies with the user or vendor. No known active exploitation has been reported.

The vulnerability allows unauthenticated access to an administrative endpoint, which could lead to unauthorized viewing or manipulation of notifications within the Gardyn Cloud API. The CVSS score of 6.9 reflects a medium severity impact, primarily due to the lack of authentication controls on a critical function. However, there is no indication of privilege escalation, data integrity, or availability impact beyond the unauthorized access to this endpoint. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently available, users should restrict network access to the affected endpoint where possible, implement compensating controls such as network-level authentication or firewall rules, and monitor for unauthorized access attempts. Follow up with Gardyn for any forthcoming patches or official mitigations.