Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck
CVE-2026-110109JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save
Medium 6.5
In plain English
A medium-severity missing authorization in JetLinks Community from jetlinks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Official description
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jetlinks | JetLinks Community | 0 – through 2.10.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/jetlinks-community-transparent-codec-save-authz-bypass third-party-advisory
- https://github.com/jetlinks/jetlinks-community/blob/60ecc9f65d96acfd38da8daecdb0062fc72034f3/jetlinks-manager/device-manager/src/main/java/org/jetlinks/community/device/web/TransparentMessageCodecController.java#L138-L143 technical-description
- https://github.com/hs-web/hsweb-framework/blob/5.0.1/hsweb-authorization/hsweb-authorization-api/src/main/java/org/hswebframework/web/authorization/Authentication.java#L206-L218 technical-description
- https://github.com/jetlinks/jetlinks-community product
- VulnCheck Advisory: JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save third-party-advisory