CVE-2025-70340

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-26 · updated 2026-10-26
Weakness: CWE-284

Description

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows unauthorized impersonation of system messages and modification of trusted system-owned data, resulting in vertical privilege escalation and potential integrity violations.

References

https://github.com/thingsboard/thingsboard
https://thingsboard.io/docs/releases/releases-table/v4-2-x/

Get alerted when CVE-2025-70340 or the next vulnerability affects your stack