Missing authorization in JetLinks Community allows codec overwrite
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
JetLinks Community through 2.10.0 contains a missing authorization flaw (CWE-862). Users with only query access on transparent-codec can overwrite product codecs through the device transparent-codec endpoint. A network attacker with low privileges can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Description from the CNA
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for JetLinks Community.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Timeline
- 2026-10-13 Threatist record created from CVE-2026-110109
- 2026-10-13 Alias added: GHSA-6q8r-vgvx-r98p
References
Advisory 1
Other 3
- https://github.com/jetlinks/jetlinks-community/blob/60ecc9f65d96acfd38da8daecdb0062fc72034f3/jetlinks-manager/device-manager/src/main/java/org/jetlinks/community/device/web/TransparentMessageCodecController.java#L138-L143
- https://github.com/hs-web/hsweb-framework/blob/5.0.1/hsweb-authorization/hsweb-authorization-api/src/main/java/org/hswebframework/web/authorization/Authentication.java#L206-L218
- https://github.com/jetlinks/jetlinks-community
More jetlinks vulnerabilities
- TI-2026-71996 Missing authorization in JetLinks Community alarm toggle endpoints CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-110109 · CVE Program
- CVE-2026-110109 · NVD
- FIRST EPSS
- GHSA-6q8r-vgvx-r98p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences