CVE-2026-110109

MEDIUM 6.5

JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.

CWE	CWE-862
Vendor	jetlinks
Product	jetlinks community
Published	Oct 13, 2026
Last Updated	Oct 13, 2026

Stay Ahead of the Next One

Get instant alerts for jetlinks jetlinks community

Be the first to know when new medium vulnerabilities affecting jetlinks jetlinks community are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Affected Versions

jetlinks / JetLinks Community

0 ≤ 2.10.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/jetlinks-community-transparent-codec-save-authz-bypass github.com: https://github.com/jetlinks/jetlinks-community/blob/60ecc9f65d96acfd38da8daecdb0062fc72034f3/jetlinks-manager/device-manager/src/main/java/org/jetlinks/community/device/web/TransparentMessageCodecController.java#L138-L143 github.com: https://github.com/hs-web/hsweb-framework/blob/5.0.1/hsweb-authorization/hsweb-authorization-api/src/main/java/org/hswebframework/web/authorization/Authentication.java#L206-L218 github.com: https://github.com/jetlinks/jetlinks-community vulncheck.com: https://www.vulncheck.com/advisories/jetlinks-community-through-2.10.0-missing-authorization-via-product-level-transparent-codec-save

Credits

hieuPenguinnn