A specific administrative endpoint within the Gardyn Cloud API can be accessed without authentication, allowing an attacker to invoke device management functions. This omission of proper authorization aligns with the missing authorization weakness identified by CWE‑306. An attacker who can reach the endpoint could potentially reconfigure, reset, or otherwise alter connected Gardyn devices, compromising device integrity and potentially leading to broader system compromise.

The vulnerability impacts Gardyn’s Cloud API, as well as the Gardyn mobile application and the Gardyn Home firmware that these components rely upon. Users are advised to run the latest version of the Gardyn mobile app and to update their Home firmware to version master.622 or newer to mitigate this risk.

The CVSS score of 8.7 classifies this flaw as high severity. Because the endpoint is accessible without authentication, the likelihood of exploitation is high for anyone who can communicate with the Gardyn Cloud API, whether through local network or internet-facing interfaces. The EPSS score is not available, and the flaw is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the inherent lack of authorization makes exploitation relatively straightforward once network access is established.