Missing Authorization Vulnerability in JetLinks Community by JetLinks
CVE-2026-110110

5.3MEDIUM

Key Information:

Vendor

Jetlinks

Status
Jetlinks Community
Vendor
CVE Published:
13 October 2026

What is CVE-2026-110110?

The JetLinks Community software, specifically through version 2.10.0, suffers from a missing authorization flaw. This vulnerability enables unauthorized users who normally have only query access to manipulate alarm configurations. By exploiting the lack of adequate authorization checks on the AlarmConfigController endpoints (_enable and _disable), an attacker can toggle alarms for monitored devices, which may lead to a significant lapse in alerting for critical system events.

Affected Version(s)

JetLinks Community 0 <= 2.10.0

References

https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/jetlinks-commun...
third-party-advisory
https://github.com/jetlinks/jetlinks-community/blob/60ecc...
technical-description
https://github.com/hs-web/hsweb-framework/blob/5.0.1/hswe...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.