Mohan mohan794

## CVE-2025-70340.md

      
        
          
            
              
              1 file
            
          
          
            
              
              0 forks
            
          
            
              
                
                0 comments
              
            
          
            
              
              0 stars
            
          
        
        
          
              
          
          
            
                mohan794
                / CVE-2025-70340.md
            
            
              Created
              April 14, 2026 16:18
            
              
                Security Advisory: Broken Access Control in ThingsBoard ≤ 4.3.1.1
              
          
        
      
        

      
      
    Security Advisory: Broken Access Control - ThingsBoard ≤ 4.3.1.1

CVE ID: CVE-2025-70340

1. Vulnerability Description

ThingsBoard versions ≤ 4.3.1.1 are affected by a Broken Access Control vulnerability (CWE-284) in the Alarms comments functionality. The issue arises due to insufficient server-side authorization checks on comment-related API endpoints.