CVE-2026-110109: Missing Authorization in jetlinks JetLinks Community

CVE-2026-110109 describes a missing authorization vulnerability in JetLinks Community through version 2.10.0. Users with only query access on the transparent-codec resource can exploit the POST /device/transparent-codec/{productId} endpoint to overwrite product codecs. The endpoint lacks the @SaveAction annotation, which results in insufficient authorization checks, allowing attackers to save arbitrary codec providers and configurations. This control over codec settings impacts the encoding and decoding of transparent messages for every device associated with the targeted product.

An attacker with limited query privileges can escalate their control to modify codec configurations for a product, potentially affecting message processing for all devices under that product. This could lead to unauthorized manipulation of device communication data, undermining data integrity and operational reliability. The vulnerability has a high severity score (CVSS 7.1) indicating significant impact potential.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict query access to the transparent-codec resource to trusted users only and monitor for suspicious activity related to codec configuration changes.