CVE-2026-110110: JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController enable and disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user who has query access can exploit the affected alarm enable and disable endpoints. Administrative or alarm-save permission is not required.
What access and actions are required to exploit it?
The attacker needs network access to the JetLinks Community instance and valid credentials with query access. They can toggle an alarm configuration by its ID through the affected endpoints.
What is the operational impact?
An attacker can enable or disable any alarm configuration, including disabling alarms used to alert on monitored-device conditions. This can silence alerts without changing confidentiality or system availability.
Which versions are affected?
JetLinks Community through version 2.10.0 is identified as affected.