A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows unauthorized impersonation of system messages and modification of trusted system-owned data, resulting in vertical [truncated]
CVE-2026-53676 is a high-severity vulnerability in ThingsBoard that allows for arbitrary code execution within a sandboxed context by a user with tenant administrator privileges. The vulnerability is caused by a prototype pollution issue. This issue can lead to significant operational impact, especially in environments where tenant administrator privileges are widespread. Users should review their exposur [truncated]
CVE-2026-36537 is an authentication bypass vulnerability in ThingsBoard v4.3.0.1. The vulnerability occurs during the OAuth authorization code exchange, where the application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote attacker can bypass authentication and gain full access to a [truncated]
A code injection vulnerability exists in ThingsBoard versions up to 4.3.1.1, specifically within the `getGatewayDockerComposeFile` function accessible via the `/api/v1/provision` endpoint. The vulnerability stems from improper handling of YAML input, allowing an attacker to inject and execute arbitrary code. The attack vector is network-based but requires high complexity and user interaction, resulting in [truncated]
