CVE-2026-28767: Missing Authentication on Administrative Notifications Endpoint

Advisory

Product

Summary

The /api/admin/notifications administrative endpoint is accessible without authentication, exposing internal notification system data and administrative communications to unauthenticated users.

Vulnerability Details

Unauthenticated Access

The administrative notifications endpoint is publicly accessible without any authentication or authorization controls:

GET [REDACTED — Cloud API host]/api/admin/notifications
Authentication: NONE

Exposed Data

The unauthenticated endpoint provides access to:

• Internal notification system data and message templates
• Administrative communications and system alerts
• Push notification configurations and delivery status
• User notification preferences and targeting data

Systemic Pattern

This endpoint is part of a broader pattern of missing authentication on the Gardyn /api/admin/* path. Both /api/admin/devices (CVE-2026-32646) and /api/admin/notifications lack authentication, suggesting the entire administrative API namespace may have been deployed without access controls.

Impact

• Information disclosure of internal administrative communications
• Visibility into operational processes and system events
• Notification template and targeting data exposure
• Reconnaissance value for identifying system behavior, user engagement patterns, and administrative workflows
• Potential for notification injection or modification if write operations are exposed

Standard Services Available for This Class of Endpoint

Remediation

Gardyn recommends upgrading to Cloud API version 2.12.2026 or later. See https://mygardyn.com/security/ for additional information.

Recommended fix for the vendor:

1. Require administrative authentication on all /api/admin/* endpoints
2. Implement role-based access control for administrative operations
3. Audit all endpoints under the /api/admin/ path for missing authentication
4. Place administrative endpoints behind a separate access-controlled path
5. Audit access logs for unauthorized access to administrative endpoints

Timeline

References

• CVE-2026-28767 -- CVE Record
• ICSA-26-055-03
• CWE-306: Missing Authentication for Critical Function

Credit

Reported by Michael Groberman — Gr0m to CISA.