EUVD-2026-18841
GHSA-v4x2-mqq5-6xqv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A specific administrative endpoint notifications is accessible without proper authentication.
AnalysisAI
Unauthenticated attackers can access administrative endpoint notifications in Gardyn Cloud API without proper authentication, allowing information disclosure via an authentication bypass vulnerability. The CVSS 6.9 score reflects the network accessibility and lack of required privileges, though impact is limited to confidentiality. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
The vulnerability exists in Gardyn Cloud API administrative endpoints that handle notifications, stemming from insufficient authentication controls classified as CWE-306 (Missing Authentication for Critical Function). The affected product is Gardyn Cloud API across multiple versions. The root cause involves an administrative endpoint that should require authentication to access sensitive notification data but does not enforce credential validation, allowing an unauthenticated remote attacker to directly access this functionality over the network without elevated privileges or user interaction.
RemediationAI
Organizations should immediately apply the security update provided by Gardyn for Cloud API to address the authentication bypass. Specific patch version numbers are not independently confirmed in the provided data; consult https://mygardyn.com/security/ and https://www.cisa.gov/news-events/ics-advisories/icsa-26-055-03 for exact remediation guidance and patched version numbers. As an interim mitigation, restrict network access to administrative endpoints via firewall or API gateway rules to limit exposure to trusted administrative networks only. Verify that all Cloud API instances require valid authentication credentials before accessing any notification or administrative endpoints.
Insecure Direct Object Reference (IDOR) vulnerability in Gardyn Cloud API allows unauthenticated remote attackers to acc
Unauthenticated access to complete user account data in Gardyn Cloud API allows remote attackers to retrieve sensitive i
Hardcoded storage credentials in Gardyn mobile application and device firmware grant unauthenticated remote attackers ac
Unauthenticated remote access to administrative endpoints in Gardyn Cloud API exposes device management functions to net
Gardyn Cloud API exposes development and test endpoints that mirror production functionality, allowing unauthenticated r
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today