CVE-2026-110110

Deferred Deferred - Pending Action

JetLinks Community Missing Authorization in Alarm Configuration

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110110

EUVD

EUVD-2026-98943

Affected Vendors & Products

Vendor	Product	Version / Range
jetlinks	JetLinks	Community 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

JetLinks Community through version 2.10.0 has a missing authorization vulnerability. It allows users with only query access to enable or disable any alarm configuration. The AlarmConfigController endpoints _enable and _disable lack the save action annotation, enabling attackers to toggle alarms by ID and silence alerts for monitored devices.

Detection Guidance

Detecting this vulnerability requires checking JetLinks Community instances for unauthorized alarm configuration changes. Review logs for suspicious POST requests to /alarm-config/_enable or /alarm-config/_disable endpoints. Check if users with only query access have modified alarm settings.

Impact Analysis

Attackers could disable alarms for critical devices, preventing alerts for actual issues. This could lead to undetected failures, security breaches, or operational disruptions in systems relying on these alarms.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to disable alarm configurations, which may lead to undetected security incidents or data breaches. Disabling alarms could prevent timely detection of device failures or security events, violating data protection and security requirements under these regulations.

Mitigation Strategies

Immediately update JetLinks Community to the latest version beyond 2.10.0. Restrict access to alarm configuration endpoints by implementing proper authorization checks. Audit all alarm configurations for unauthorized changes and review user permissions to ensure least privilege access.

Hi! I’m here to help you understand CVE-2026-110110. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70