CVE-2026-32646: Missing Authentication on Administrative Device Management Endpoint

Advisory

Product

Summary

The /api/admin/devices administrative endpoint for device management is accessible without authentication. This endpoint exposes device enumeration, metadata retrieval, and device management functions intended for administrative use only.

Vulnerability Details

Unauthenticated Administrative Access

The administrative device management endpoint is publicly accessible without any authentication or authorization controls:

GET [REDACTED — Cloud API host]/api/admin/devices
Authentication: NONE

Exposed Functions

The unauthenticated endpoint enables:

• Device enumeration -- list all registered devices in the fleet
• Device metadata -- serial numbers, firmware versions, online/offline status, last seen timestamps
• Device-to-user mapping -- which user owns which device
• Device management operations -- administrative CRUD operations on device records

Relationship to Other Findings

This endpoint provides an alternative path to device enumeration that does not require the IoT Hub credential (CVE-2025-1242). While CVE-2025-1242 enables enumeration via the Azure IoT Hub registry, this endpoint enables enumeration via the Gardyn backend API -- two independent paths to the same data.

Combined with CVE-2026-25197 (IDOR), device IDs obtained from this endpoint can be used to pivot to user PII via the REST API.

Impact

• Complete device fleet enumeration without authentication (~138,160 registered devices)
• Device metadata exposure (serials, firmware versions, status) enables targeted attacks
• Device-to-user correlation enables privacy violations at scale
• Provides reconnaissance data for exploiting CVE-2025-1242 (IoT Hub credentials) and CVE-2025-29631 (command injection)
• Administrative function exposure may enable device manipulation

Standard Services Available for This Class of Endpoint

Remediation

Gardyn recommends upgrading to Cloud API version 2.12.2026 or later. See https://mygardyn.com/security/ for additional information.

Recommended mitigations for device owners:

• Isolate the Gardyn device on a dedicated VLAN or IoT network segment

Recommended fix for the vendor:

1. Require administrative authentication on all /api/admin/* endpoints
2. Implement role-based access control separating admin and user operations
3. Place administrative endpoints behind a separate access-controlled path (not on the public API)
4. Audit administrative endpoint access logs for unauthorized access
5. Implement rate limiting on device listing endpoints

Timeline

References

• CVE-2026-32646 -- CVE Record
• ICSA-26-055-03
• CWE-306: Missing Authentication for Critical Function

Credit

Reported by Michael Groberman — Gr0m to CISA.