nerves-hub nerves_hub_web up to 2.5.2 Devices Page Bulk Move NervesHub.Products.get_by_id improper authorization

Summaryinfo

A vulnerability marked as problematic has been reported in nerves-hub nerves_hub_web up to 2.5.2. Affected is the function NervesHub.Products.get_by_id of the component Devices Page Bulk Move. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-120295. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in nerves-hub nerves_hub_web up to 2.5.2. It has been rated as problematic. This issue affects the function NervesHub.Products.get_by_id of the component Devices Page Bulk Move. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via the "Move device(s) to product" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product's organization at any role, and move-devices-product then changes each selected device's organization and product. The device API's move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter. A moved device keeps its key and certificate, joins the target organization's matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization. This issue affects nerves_hub: from 1.0.0 before 2.5.3.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-120295 since 11/06/2026. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading to version 2.5.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• nerves-hub

Name

• nerves_hub_web

Version

• 2.5.0
• 2.5.1
• 2.5.2

Website

• Product: https://github.com/nerves-hub/nerves_hub_web/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion