CVE-2026-110109

Versions of JetLinks Community through 2.10.0 are susceptible to a missing authorization vulnerability (CWE-862) in the transparent-codec component. An attacker with only query access can exploit the POST /device/transparent-codec/{productId} endpoint, which lacks the required @SaveAction permiss...