CVE-2026-120286
Received Received - Intake

Missing Authorization in NervesHub Web Application

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: EEF

Description
Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member. A view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to. This issue affects nerves_hub: from 1.0.0 before 2.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-120286
EUVD
EUVD-2026-120873

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nerves-hub nerves_hub_web From 1.0.0 (inc) to 2.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Missing Authorization vulnerability in the Nerves Hub web application (nerves_hub_web) affecting versions 1.0.0 to 2.5.2. It allows authenticated users with the 'view' role to perform actions reserved for the 'manage' role, such as modifying device certificates, tags, locations, and deployment groups. The vulnerability occurs because event handlers do not enforce proper authorization checks, enabling unauthorized changes within the user's organization.

Detection Guidance

Check NervesHub web interface logs for unauthorized certificate changes, device group modifications, or tag updates performed by 'view' role users. Review LiveView event logs for actions like certificate additions/deletions, deployment group changes, or location updates. Inspect device certificate lists for unexpected entries or missing certificates.

Impact Analysis

An attacker with the 'view' role could add or delete device certificates, allowing unauthorized access to devices. They could also change firmware assignments, move devices between deployment groups, or remove devices entirely. Sensitive data like local shell output may also be exposed. The impact is limited to actions within the user's organization.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing device communications or allowing unauthorized modifications to systems handling protected data. Compliance may be impacted if unauthorized changes or data exposure occur.

Mitigation Strategies

Upgrade NervesHub to version 2.5.3 or later to apply security patches. Review and remove any unauthorized device certificates added by 'view' role users. Restrict 'view' role permissions to trusted individuals only. Disable the local shell extension if not required until upgrade completion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120286. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...