CVE-2026-110109 Details

A missing authorization vulnerability has been identified in JetLinks Community versions through 2.10.0. This vulnerability allows users with only query access on the 'transparent-codec' resource to overwrite product codecs via a POST request to '/device/transparent-codec/{productId}'. The issue arises because the endpoint does not include the '@SaveAction' annotation, which is necessary for authorization checks on write operations. As a result, attackers can manipulate codec providers and configurations, thereby controlling how transparent messages are decoded and encoded for all devices under the affected product.

The vulnerability can be addressed by adding the missing '@SaveAction' annotation to the product-level codec save handler in the 'TransparentMessageCodecController'. This change will ensure that the handler requires the appropriate authorization before allowing any modifications.