CVE-2022-45608: Thingsboard

High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days.

An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers (CUSTOMER_USER) to gain escalated privileges (vertically) and become an Administrator (TENANT_ADMIN) or (SYS_ADMIN) on the web application. It is important to note that in order to accomplish this, the attacker must know the corresponding API's parameter (authority : value).

Affected products

• Thingsboard Thingsboard: version 3.4.1 only

Published 2023-03-01. Last modified 2026-07-09.