# CVE-2025-70340: ThingsBoard Professional Edition broken access control in alarm comments

Source: https://junglewise.ai/threats/cve-2025-70340-thingsboard-professional-edition-broken-access-control-in-alarm  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-70340 · Severity: medium · CVSS 6.5 · Published 2026-08-26

ThingsBoard Professional Edition is an open-source IoT platform used to manage devices, collect data, and visualize system information. A vulnerability in the alarm comments feature allows authenticated users to impersonate system messages and modify trusted system data, potentially escalating privileges or tampering with critical alerts and audit trails.

Vendors: [ThingsBoard](https://junglewise.ai/threats/vendors/thingsboard).

## Quick answers

**Is CVE-2025-70340 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-70340 being exploited in the wild.

**How severe is CVE-2025-70340?** Medium severity, with a CVSS score of 6.5, published 26 August 2026.

**Which products and versions are affected?** ThingsBoard Professional Edition 4.21 and below.

**Is there a fix for CVE-2025-70340?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-70340 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-70340?** Check whether you run ThingsBoard Professional Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in ThingsBoard PE 4.21 and below in the alarm comments functionality. Authenticated customer users can manipulate API request parameters to create or modify system-generated alarm comments, bypassing authorization checks that should restrict such operations to the system only. This enables vertical privilege escalation and integrity violations through impersonation of system messages and modification of system-owned data. The vulnerability requires authentication but allows low-privileged users to perform actions restricted to higher privilege levels or system components.

## Affected products

- ThingsBoard Professional Edition 4.21 and below

## Timeline

- 2026-08-26: disclosed

## References

- [https://github.com/thingsboard/thingsboard](https://github.com/thingsboard/thingsboard)
- [https://thingsboard.io/docs/releases/releases-table/v4-2-x/](https://thingsboard.io/docs/releases/releases-table/v4-2-x/)