CVE-2026-28766

36th percentile - higher than 36% of all known CVEs

A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.

An unauthenticated attacker can access sensitive user data, such as personal information, potentially leading to identity theft or privacy breaches.

Immediately secure this endpoint by requiring authentication, and notify users about the potential data leak.