CVE-2026-120730
HighCVSS 8.6Summary
An Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms, and JITP settings in nerves_hub_web allows an authenticated user who manages devices in one organization to write into other organizations via submitted org_id, product_id, and deployment_id fields. A device placed on another organization's deployment group is sent that organization's firmware with a download URL.
Risk Assessment
A user with manage role in their own organization can move devices into another organization, potentially leading to unauthorized access to firmware and device information. This can breach organizational isolation and firmware supply chain security.
Recommendation
Update nerves_hub to version 2.5.3 or later. Review user permissions and restrict manage roles to trusted individuals.
Other vulnerabilities in nerves_hub_web
See all- CVE-2026-120999High
An Improper Authentication vulnerability in Google sign-in and email confirmation in nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. The system signs a Google user into any account with the same email without the owner proving ownership.
- CVE-2026-120997Low
Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The role is read once when a page mounts and membership is checked once at channel join, so changes are not propagated. The dashboard also opens consoles with a token valid for 24 hours that is not revoked by signing out.
- CVE-2026-120295High
An Incorrect Authorization vulnerability in the devices page bulk move in nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product. A moved device keeps its key and certificate and joins the target organization's deployment groups.
- CVE-2026-120286Medium
Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers carry out changes without calling authorized!/2, and the pages render the controls to every member. A view member can add or delete certificates, change tags, manual location, deployment group membership, and start, retry or delete firmware delta builds.
- CVE-2026-119446Critical
A Session Fixation vulnerability in the CLI login flow in nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. The confirmation code is only displayed and never compared, so it cannot prove that the confirming person is the one who started the login.
Original NVD description (English source)
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one. A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it. This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS