This vulnerability (CVE-2026-32646) affects the Gardyn Cloud API by exposing an administrative endpoint that lacks proper authentication, enabling unauthorized users to access device management capabilities. The CVSS 4.0 score of 8.7 reflects a high-severity issue with network attack vector, no required privileges or user interaction, and high impact on confidentiality. The vulnerability is categorized as CWE-306 (Missing Authentication for Critical Function). No patch or official remediation guidance has been published, and the product is not a cloud service, so remediation responsibility lies with the vendor and users.

Unauthorized actors can access administrative device management functions through the exposed endpoint, potentially leading to unauthorized control or manipulation of devices managed by the Gardyn Cloud API. The high CVSS score indicates significant confidentiality impact, but integrity and availability impacts are not indicated. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected administrative endpoint through network controls or other compensating controls to prevent unauthorized access. Monitor vendor communications for updates on patches or official mitigations.