The Gardyn Cloud API includes development and test API endpoints that mirror the functionality of the production API. Such endpoints can introduce security risks if they are accessible in a production environment, as they may bypass security controls or expose sensitive features. This issue is tracked as CVE-2026-32662 and categorized under CWE-489. The CVSS 4.0 base score is 6.9, indicating a medium severity vulnerability with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality. No official remediation or patch information is currently available.

The presence of development and test API endpoints in the production environment can lead to unauthorized access or unintended exposure of functionality that may not be secured to production standards. This could result in information disclosure or manipulation of API operations. However, the impact is rated as medium severity, and no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to development and test endpoints, remove or disable such endpoints from production environments, and monitor for any unauthorized access attempts related to these endpoints.