MinorCritical vulnerability

CVE-2026-110109 (CVSS 7.1)

NVD · officialPublished Oct 13, 2026Risk 23/100

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec providers and configurations, controlling how transparent messages are decoded and encoded for every device of that product.

Technical details

CVSS

7.1

AV:NetworkAC:LowPR:LowUI:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source