The Gardyn Cloud API contains an administrative endpoint for notifications that can be reached without proper authentication. The flaw, which is a missing authentication check, is classified as CWE‑306. Because the endpoint is intended to perform privileged administrative actions, an attacker who reaches it may execute those actions without authorization, exposing administrative functionality that should be protected.

The vulnerability affects the Gardyn Cloud API as used by the Gardyn mobile application and the Gardyn Home firmware. Gardyn’s own guidance states that the fix is included in the latest version of the Gardyn mobile application and that users should maintain Home firmware at master.622 or later to mitigate the issue.

The CVSS score is 6.9, indicating a medium‑to‑high severity level. No EPSS score is reported and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote access to the Gardyn Cloud endpoint; any actor who can reach the API could exploit the lack of authentication to access the administrative function.