nerves-hub nerves_hub_web up to 2.5.2 Device API NervesHub.Devices.Device.changeset org_id/product_id/deployment_id dynamically-determined object attributes

Summaryinfo

A vulnerability labeled as problematic has been found in nerves-hub nerves_hub_web up to 2.5.2. This impacts the function NervesHub.Devices.Device.changeset of the component Device API. Executing a manipulation of the argument org_id/product_id/deployment_id can lead to dynamically-determined object attributes. This vulnerability appears as CVE-2026-120730. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in nerves-hub nerves_hub_web up to 2.5.2. It has been declared as problematic. This vulnerability affects the function NervesHub.Devices.Device.changeset of the component Device API. The manipulation of the argument org_id/product_id/deployment_id with an unknown input leads to a dynamically-determined object attributes vulnerability. The CWE definition for the vulnerability is CWE-915. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one. A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it. This issue affects nerves_hub: from 1.0.0 before 2.5.3.

The advisory is available at github.com. This vulnerability was named CVE-2026-120730 since 11/03/2026. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 2.5.3 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• nerves-hub

Name

• nerves_hub_web

Version

• 2.5.0
• 2.5.1
• 2.5.2

Website

• Product: https://github.com/nerves-hub/nerves_hub_web/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion