CVE-2026-120286
MediumCVSS 5.3Summary
Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers carry out changes without calling authorized!/2, and the pages render the controls to every member. A view member can add or delete certificates, change tags, manual location, deployment group membership, and start, retry or delete firmware delta builds.
Risk Assessment
A low-privileged organization member can take control of devices by adding a certificate that allows connecting as the device or by changing which firmware a device receives. This can compromise the integrity and confidentiality of the device fleet.
Recommendation
Update nerves_hub to version 2.5.3 or later and verify that view roles do not hold unnecessary permissions.
Other vulnerabilities in nerves_hub_web
See all- CVE-2026-120999High
An Improper Authentication vulnerability in Google sign-in and email confirmation in nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. The system signs a Google user into any account with the same email without the owner proving ownership.
- CVE-2026-120997Low
Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The role is read once when a page mounts and membership is checked once at channel join, so changes are not propagated. The dashboard also opens consoles with a token valid for 24 hours that is not revoked by signing out.
- CVE-2026-120730High
An Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms, and JITP settings in nerves_hub_web allows an authenticated user who manages devices in one organization to write into other organizations via submitted org_id, product_id, and deployment_id fields. A device placed on another organization's deployment group is sent that organization's firmware with a download URL.
- CVE-2026-120295High
An Incorrect Authorization vulnerability in the devices page bulk move in nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product. A moved device keeps its key and certificate and joins the target organization's deployment groups.
- CVE-2026-119446Critical
A Session Fixation vulnerability in the CLI login flow in nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. The confirmation code is only displayed and never compared, so it cannot prove that the confirming person is the one who started the login.
Original NVD description (English source)
Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member. A view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to. This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS