CVE-2026-110110 Details
Description
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices.
A missing authorization vulnerability has been identified in JetLinks Community versions through 2.10.0. This vulnerability allows users with only query access to enable or disable any alarm configuration. The issue arises because the AlarmConfigController's _enable and _disable endpoints do not include the necessary save action annotation. As a result, attackers can manipulate alarm states by ID, silencing alerts for monitored devices.
The missing save action annotation should be added to the '_enable' and '_disable' endpoints in the AlarmConfigController. This will ensure that the same permission requirements are enforced as for the other alarm management actions that involve saving.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| JetLinks Community | <= 2.10.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |