PatchTheCVEcloud api vulnerabilities and fixes
Recent CVEs affecting cloud api, with upgrade or downgrade steps. 5 tracked.
Also searched as: cloudapi.
cloud api has 5 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-04-03. Highest priority: CVE-2026-28766 (score 47/100).
- CVE-2026-28766 CRITICAL 9.3 UPGRADE A specific endpoint exposes all user account information for registered Gardyn users without requiring authent
- CVE-2026-25197 CRITICAL 9.1 UPGRADE A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in t
- CVE-2026-32646 HIGH 7.5 UPGRADE A specific administrative endpoint is accessible without proper authentication, exposing device management fun
- CVE-2026-28767 MEDIUM 5.3 UPGRADE A specific administrative endpoint notifications is accessible without proper authentication.
- CVE-2026-32662 MEDIUM 5.3 UPGRADE Development and test API endpoints are present that mirror production functionality.
FAQ
How do I fix cloud api vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is cloud api being exploited right now?
None of the tracked cloud api CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which cloud api CVE should I patch first?
CVE-2026-28766 currently ranks highest (47/100): A specific endpoint exposes all user account information for registered Gardyn users without requiring authent.