CVE-2026-110110
MediumCVSS 4.3Summary
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices.
Risk Assessment
The risk includes the ability to silence alarms, which could lead to missed incidents and delayed response to device issues.
Recommendation
Add proper authorization annotations (e.g., @SaveAction) to the _enable and _disable endpoints, and restrict configuration changes to users with appropriate permissions.
Other vulnerabilities in JetLinks Community
See all- CVE-2026-110109Medium
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.
- CVE-2026-75340Critical
The device metadata import interface /device/instance/{productId}/property-metadata/import in jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).
Original NVD description (English source)
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS