# CVE-2026-110110: JetLinks Community missing authorization in alarm control

Source: https://junglewise.ai/threats/cve-2026-110110-jetlinks-community-through-2-10-0-contains-a-missing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110110 · Severity: medium · CVSS 4.3 · Published 2026-10-13

JetLinks Community is an IoT platform that manages connected devices and triggers alerts when problems occur. A vulnerability allows users with only read-only query access to enable or disable any alarm configuration, which could allow attackers to silence alerts and prevent detection of device failures or intrusions.

Technologies: [JetLinks Community](https://junglewise.ai/threats/technologies/jetlinks-community). Vendors: [JetLinks](https://junglewise.ai/threats/vendors/jetlinks).

## Quick answers

**Is CVE-2026-110110 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110110 being exploited in the wild.

**How severe is CVE-2026-110110?** Medium severity, with a CVSS score of 4.3, published 13 October 2026.

**Which products and versions are affected?** JetLinks Community through 2.10.0.

**Is there a fix for CVE-2026-110110?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-110110 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-110110?** Check whether you run JetLinks Community at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The AlarmConfigController _enable and _disable endpoints lack proper authorization checks (missing save action annotation), allowing any authenticated user with query permission to toggle alarm configurations by ID. An attacker with read-only access can make HTTP requests to these endpoints to disable alarms and prevent monitoring of IoT devices. A fix exists in versions after 2.10.0.

## Affected products

- JetLinks Community through 2.10.0

## Timeline

- 2026-10-13: disclosed

## References

- [https://github.com/hs-web/hsweb-framework/blob/5.0.1/hsweb-authorization/hsweb-authorization-api/src/main/java/org/hswebframework/web/authorization/Authentication.java](https://github.com/hs-web/hsweb-framework/blob/5.0.1/hsweb-authorization/hsweb-authorization-api/src/main/java/org/hswebframework/web/authorization/Authentication.java)
- [https://github.com/jetlinks/jetlinks-community](https://github.com/jetlinks/jetlinks-community)

## Related threats

- [JetLinks Community authorization bypass in transparent codec endpoint](https://junglewise.ai/threats/cve-2026-110109-jetlinks-community-through-2-10-0-contains-a-missing)
- [JetLinks Community Server-Side Request Forgery in device metadata import](https://junglewise.ai/threats/cve-2026-75340-jetlinks-community-server-side-request-forgery-in-device-metadata)