CVE-2026-110109: JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who has query-only access to transparent-codec can exploit it. No user interaction is required.
What access does an attacker gain over affected products?
The attacker can overwrite the transparent codec provider and configuration for a targeted product. This lets them control how transparent messages are decoded and encoded for every device associated with that product.
Which endpoint should be restricted while a fix is unavailable?
Restrict POST requests to /device/transparent-codec/{productId} to users explicitly authorized to save or modify product codecs. Query-only transparent-codec permissions should not permit this operation.