Missing Authorization Vulnerability in JetLinks Community Product
CVE-2026-110109

7.1HIGH

Key Information:

Vendor

Jetlinks

Status
Jetlinks Community
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110109?

The JetLinks Community product, up to version 2.10.0, suffers from a missing authorization vulnerability in its transparent-codec functionality. This flaw permits users with query access to the transparent-codec endpoint to bypass necessary authorization measures. By leveraging the POST method at /device/transparent-codec/{productId}, an attacker can introduce arbitrary codec providers and configurations, thereby gaining control over the encoding and decoding processes for all devices associated with that product. The absence of @SaveAction significantly increases the risk, making it imperative for users to update and secure their systems.

Affected Version(s)

JetLinks Community 0 <= 2.10.0

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/jetlinks-commun...
third-party-advisory
https://github.com/jetlinks/jetlinks-community/blob/60ecc...
technical-description
https://github.com/hs-web/hsweb-framework/blob/5.0.1/hswe...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.