CVE-2026-120295
Received Received - Intake

Incorrect Authorization in NervesHub Web Devices Page

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: EEF

Description
Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via the "Move device(s) to product" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product's organization at any role, and move-devices-product then changes each selected device's organization and product. The device API's move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter. A moved device keeps its key and certificate, joins the target organization's matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization. This issue affects nerves_hub: from 1.0.0 before 2.5.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-120295
EUVD
EUVD-2026-120867

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nerves-hub nerves_hub_web From 1.0.0 (inc) to 2.5.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Incorrect Authorization vulnerability in the Nerves Hub Web application. It allows an authenticated user with the 'manage' role in one organization and only the 'view' role in another to move their own devices into the second organization's product via the bulk move feature. The system checks the user's role in the source organization but fails to verify it in the target organization, allowing unauthorized device movement.

Detection Guidance

To detect this vulnerability, check the NervesHub Web application version. If it is between 1.0.0 and 2.5.2, the system is vulnerable. Review device move logs for unauthorized transfers between organizations. Look for users with 'manage' role in one organization and 'view' role in another performing bulk device moves.

Impact Analysis

An attacker could move devices to an organization where they only have view access, allowing them to receive firmware updates and device data from that organization. The moved devices retain their authentication credentials and join the target organization's deployment groups, potentially exposing sensitive information or disrupting operations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Unauthorized device movement may result in data breaches or improper access to regulated information.

Mitigation Strategies

Upgrade NervesHub Web to version 2.5.3 or later immediately. Review and revoke any unauthorized device moves. Ensure users have appropriate roles in target organizations before allowing device transfers. Monitor logs for suspicious bulk move actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120295. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...