CVE-2026-120295
HighCVSS 7.1Summary
An Incorrect Authorization vulnerability in the devices page bulk move in nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product. A moved device keeps its key and certificate and joins the target organization's deployment groups.
Risk Assessment
A user with limited view role in the target organization can move devices into it, gaining access to firmware and information they are not normally entitled to. This can breach access control and organizational security.
Recommendation
Update nerves_hub to version 2.5.3 or later. Review user roles across organizations and restrict device move capabilities.
Other vulnerabilities in nerves_hub_web
See all- CVE-2026-120999High
An Improper Authentication vulnerability in Google sign-in and email confirmation in nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. The system signs a Google user into any account with the same email without the owner proving ownership.
- CVE-2026-120997Low
Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The role is read once when a page mounts and membership is checked once at channel join, so changes are not propagated. The dashboard also opens consoles with a token valid for 24 hours that is not revoked by signing out.
- CVE-2026-120730High
An Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms, and JITP settings in nerves_hub_web allows an authenticated user who manages devices in one organization to write into other organizations via submitted org_id, product_id, and deployment_id fields. A device placed on another organization's deployment group is sent that organization's firmware with a download URL.
- CVE-2026-120286Medium
Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers carry out changes without calling authorized!/2, and the pages render the controls to every member. A view member can add or delete certificates, change tags, manual location, deployment group membership, and start, retry or delete firmware delta builds.
- CVE-2026-119446Critical
A Session Fixation vulnerability in the CLI login flow in nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. The confirmation code is only displayed and never compared, so it cannot prove that the confirming person is the one who started the login.
Original NVD description (English source)
Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via the "Move device(s) to product" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product's organization at any role, and move-devices-product then changes each selected device's organization and product. The device API's move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter. A moved device keeps its key and certificate, joins the target organization's matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization. This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS