The Gardyn Cloud API contains a vulnerability (CVE-2026-32646) classified as CWE-306 due to an administrative endpoint that lacks proper authentication. This flaw enables unauthenticated attackers to access device management functionalities remotely. The CVSS 4.0 base score is 8.7, reflecting high severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality. The vulnerability affects version 0 of the product. No patch or official remediation level has been disclosed, and the product is not a cloud-hosted service, so remediation responsibility lies with the vendor and users.

Unauthorized actors can access administrative device management functions via the exposed endpoint without authentication, potentially leading to unauthorized control or disclosure of sensitive device management data. The high CVSS score indicates significant risk if exploited. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected administrative endpoint where possible and monitor for unusual activity related to device management functions. Follow vendor updates closely for any forthcoming patches or mitigation instructions.