CVE-2026-120295
Gravedad CVSS v4.0:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
10/11/2026
Última modificación:
10/11/2026
Descripción
*** Pendiente de traducción *** Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization&#39;s product via the "Move device(s) to product" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product&#39;s organization at any role, and move-devices-product then changes each selected device&#39;s organization and product. The device API&#39;s move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter.<br />
<br />
A moved device keeps its key and certificate, joins the target organization&#39;s matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization.<br />
<br />
This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Impacto
Puntuación base 4.0
7.10
Gravedad 4.0
ALTA
Referencias a soluciones, herramientas e información
- https://cna.erlef.org/cves/CVE-2026-120295.html
- https://github.com/nerves-hub/nerves_hub_web/commit/1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa
- https://github.com/nerves-hub/nerves_hub_web/commit/79743ef08f7f801617b653fd09f37c01ed9b4be0
- https://github.com/nerves-hub/nerves_hub_web/commit/adaeefdb7a835525482588f43332ef988cc448c7
- https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-2j7r-q3vm-8j34
- https://osv.dev/vulnerability/EEF-CVE-2026-120295