The Gardyn Cloud API contains a critical endpoint that returns all authenticated user account information. The endpoint does not enforce authentication, allowing anyone to retrieve sensitive personal data about Gardyn users. This flaw enables disclosure of private information, including usernames, email addresses, and potentially other profile details, without any login or authorization.

The vulnerability affects the Gardyn Cloud API, specifically the endpoint exposed to the Gardyn mobile application and underlying Home firmware. The fix is bundled in the latest version of the Gardyn mobile app; users must run a supported app version. Additionally, all Gardyn Home kit and studio devices should be upgraded to master.622 or later for complete remediation.

The CVSS score of 9.2 classifies this flaw as critical, reflecting high confidentiality impact. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation yet. Because the API bypasses authentication entirely, an attacker with network access to the Gardyn API can exploit it immediately. The lack of an authentication check, combined with the high CVSS, signals a high risk of data exposure for all affected users.