Platform
other
Component
gardyn
Fixed in
2.12.2026
CVE-2026-28766 describes a critical information disclosure vulnerability affecting the Gardyn Cloud API. This flaw allows an attacker to retrieve all user account information without authentication, potentially exposing sensitive data like usernames, email addresses, and other profile details. The vulnerability impacts versions 0.0.0 through 2.12.2026 of the API, and a fix is available in version 2.12.2026.
The impact of CVE-2026-28766 is significant due to the ease of exploitation and the sensitivity of the exposed data. An attacker can simply access a specific endpoint within the Gardyn Cloud API to retrieve a complete list of user accounts and their associated information. This data can be used for identity theft, phishing attacks, or account takeover. The lack of authentication required for this access dramatically lowers the barrier to entry for malicious actors, increasing the risk of widespread compromise. The potential blast radius extends to all Gardyn users, as their personal information is at risk.
CVE-2026-28766 was publicly disclosed on April 3, 2026. There is currently no indication of active exploitation or inclusion in the CISA KEV catalog. Public proof-of-concept code is not yet available, but the ease of exploitation suggests it is likely to emerge. The vulnerability's severity and the sensitivity of the exposed data make it a high-priority concern.
Exploit Status
EPSS
0.08% (24% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-28766 is to immediately upgrade the Gardyn Cloud API to version 2.12.2026 or later. If upgrading is not immediately feasible, consider implementing temporary measures such as restricting access to the vulnerable endpoint through a Web Application Firewall (WAF) or proxy server. Configure the WAF to block any requests to the exposed endpoint that lack proper authentication. Monitor API logs for unusual activity, specifically looking for unauthorized access attempts to the endpoint. After upgrading, confirm the fix by attempting to access the endpoint without authentication; it should now return an authentication error.
Update the Gardyn Cloud API to version 2.12.2026 or later to implement the necessary authentication on the vulnerable endpoint. This will prevent the unauthorized exposure of user account information.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-28766 is a critical vulnerability in the Gardyn Cloud API where unauthenticated access exposes all user account information. It has a CVSS score of 9.3 and affects versions 0.0.0–2.12.2026.
If you are a Gardyn user and are running the Gardyn Cloud API version 0.0.0 through 2.12.2026, you are potentially affected by this vulnerability.
Upgrade the Gardyn Cloud API to version 2.12.2026 or later to resolve the vulnerability. As a temporary measure, restrict access to the vulnerable endpoint using a WAF.
There is currently no confirmed evidence of active exploitation, but the ease of exploitation suggests it is a potential risk.
Please refer to the official Gardyn security advisory for detailed information and updates regarding CVE-2026-28766.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.