michaeladamgroberman/cve-2026-28766CVE-2026-28766: Missing Authentication on User Account Endpoint — Gardyn Home Kit (ICSA-26-055-03)
Missing Authentication: User Account Endpoint
| Field | Value |
|---|---|
| CVE | CVE-2026-28766 |
| Severity | Critical (9.3) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N |
| Weakness (CWE) | CWE-306: Missing Authentication for Critical Function |
| Affected components | Cloud API <2.12.2026 |
| Vendor | Gardyn Inc. |
| Affected products | Gardyn Home Kit Models 1.0, 2.0, 3.0, 4.0; Gardyn Studio Models 1.0, 2.0 |
| Sector | Food and Agriculture (CISA classification) |
| Status per CISA Update A | Remediated |
Per the CISA advisory, an unauthenticated cloud API endpoint (/api/users) exposed records described in the advisory as "all user account information" for approximately 134,215 customers.
A separately-cataloged single-record companion endpoint (/api/user/{id}, published as CVE-2026-25197) returned per-user records — including physical addresses — by sequential integer ID with no authentication, making the same user space enumerable one record at a time.
Per CISA Update A (April 2, 2026), this CVE is remediated. The fix versions stated by CISA are: Gardyn mobile application 2.11.0 or later; Gardyn cloud API 2.12.2026 or later; Home Kit firmware master.622 or later.
Reported by Michael Groberman — Gr0m to CISA via CERT/CC VINCE Case VU#653116.
