A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows unauthorized impersonation of system messages and modification of trusted system-owned data, resulting in vertical privilege escalation and potential integrity violations.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Thingsboard |
|
No data.
No data.
References
History
Thu, 27 Aug 2026 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Thingsboard
Thingsboard thingsboard |
|
| Vendors & Products |
Thingsboard
Thingsboard thingsboard |
Wed, 26 Aug 2026 21:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Broken Access Control in ThingsBoard Alarm Comments Enables Privilege Escalation | |
| Weaknesses | CWE-284 CWE-285 |
Wed, 26 Aug 2026 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows unauthorized impersonation of system messages and modification of trusted system-owned data, resulting in vertical privilege escalation and potential integrity violations. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2026-08-26T00:00:00.000Z
Updated: 2026-08-26T19:09:02.220Z
Reserved: 2026-01-09T00:00:00.000Z
Link: CVE-2025-70340
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-26T20:16:59.823
Modified: 2026-08-26T20:16:59.823
Link: CVE-2025-70340
Redhat
No data.