CVE-2025-70340

Received Received - Intake

Broken Access Control in ThingsBoard PE Alarms Comments

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: MITRE

Description

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows unauthorized impersonation of system messages and modification of trusted system-owned data, resulting in vertical privilege escalation and potential integrity violations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2025-70340

Affected Vendors & Products

Vendor	Product	Version / Range
thingsboard	professional_edition	to 4.21 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Broken Access Control vulnerability in ThingsBoard Professional Edition 4.21 and earlier. An authenticated customer user can manipulate API request parameters to create or modify system-generated alarm comments. This allows them to impersonate system messages and alter trusted system data, leading to privilege escalation and integrity violations.

Impact Analysis

An attacker could gain unauthorized access to modify system messages, alter alarm data, or escalate privileges. This could lead to data tampering, false system alerts, or unauthorized actions performed under system authority, potentially compromising the integrity and trustworthiness of the system.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized data modification and access control bypasses. GDPR requires data integrity and access controls, while HIPAA mandates strict access controls for protected health information. Exploitation could lead to non-compliance and potential legal consequences.

Mitigation Strategies

Upgrade ThingsBoard Professional Edition to a version higher than 4.21 to address the Broken Access Control vulnerability in Alarms comments functionality.

Hi! I’m here to help you understand CVE-2025-70340. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70