CVE-2025-70340CWE-284broken-access-control

CVE-2025-70340

Medium · published August 27, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
12.0
In the wild
Unconfirmed
What it is

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows unauthorized impersonation of system messages and modification of trusted system-owned data, resulting in vertical privilege escalation and potential integrity violations.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00221 · 12.0th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-08-27T00:16Z
References (2)
https://github.com/thingsboard/thingsboard · [email protected]https://thingsboard.io/docs/releases/releases-table/v4-2-x/ · [email protected]
EPSS history
Timeline
  • 28 AUG 06:26Z
    EPSS moved — → 0%
    epss
  • 26 AUG 00:00Z
    A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality
    cvelistv5