CVE-2026-110110

Impact

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices.

Affected products

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

References

• NVD record
• CVE.org record
• https://github.com/hs-web/hsweb-framework/blob/5.0.1/hsweb-authorization/hsweb-authorization-api/src/main/java/org/hswebframework/web/authorization/Authentication.java#L206-L218
• https://github.com/jetlinks/jetlinks-community
• https://github.com/jetlinks/jetlinks-community/blob/60ecc9f65d96acfd38da8daecdb0062fc72034f3/jetlinks-manager/rule-engine-manager/src/main/java/org/jetlinks/community/rule/engine/web/AlarmConfigController.java#L63-L73
• https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/jetlinks-community-transparent-codec-save-authz-bypass
• https://www.vulncheck.com/advisories/jetlinks-community-through-2.10.0-missing-authorization-via-alarm-enable-disable-endpoints