CVE-2026-120730
Gravedad CVSS v4.0:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
10/11/2026
Última modificación:
10/11/2026
Descripción
*** Pendiente de traducción *** Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session&#39;s organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user&#39;s own organization, and any account can create one.<br />
<br />
A device placed on another organization&#39;s deployment group, or moved into its product, is sent that organization&#39;s firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.<br />
<br />
This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Impacto
Puntuación base 4.0
8.60
Gravedad 4.0
ALTA
Referencias a soluciones, herramientas e información
- https://cna.erlef.org/cves/CVE-2026-120730.html
- https://github.com/nerves-hub/nerves_hub_web/commit/c367d7d17d07f843e78a70d15904665616dde964
- https://github.com/nerves-hub/nerves_hub_web/commit/f58d58233dbd355c58d3a140107ece18e8863f14
- https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-rpp7-x9hm-jrmr
- https://osv.dev/vulnerability/EEF-CVE-2026-120730