Security Advisory catalog CVE-2026-120286
cve-program · CVE-2026-120286 Published
Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member.
A view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to.
This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-120286 Published nerves-hub/nerves-hub https://ghcr.io
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"collectionURL": "https://ghcr.io",
"cpes": [
"cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'",
"'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab'",
"'Elixir.NervesHubWeb.Live.DeploymentGroups.Show'",
"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary'"
],
"packageName": "nerves-hub/nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub%2Fnerves-hub",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/components/device_page/settings_tab.ex",
"lib/nerves_hub_web/components/device_page/details_tab.ex",
"lib/nerves_hub_web/live/deployment_groups/show.ex",
"lib/nerves_hub_web/components/deployment_group_page/summary.ex"
],
"programRoutines": [
{
"name": "'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':handle_progress/3"
},
{
"name": "'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab':hooked_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Live.DeploymentGroups.Show':handle_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_progress/3"
}
],
"vendor": "nerves-hub",
"versions": [
{
"lessThan": "2.5.3",
"status": "affected",
"version": "1.0.0",
"versionType": "other"
}
]
} nerves_hub Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"cpes": [
"cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'",
"'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab'",
"'Elixir.NervesHubWeb.Live.DeploymentGroups.Show'",
"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary'"
],
"packageName": "nerves_hub",
"packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/components/device_page/settings_tab.ex",
"lib/nerves_hub_web/components/device_page/details_tab.ex",
"lib/nerves_hub_web/live/deployment_groups/show.ex",
"lib/nerves_hub_web/components/deployment_group_page/summary.ex"
],
"programRoutines": [
{
"name": "'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':handle_progress/3"
},
{
"name": "'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab':hooked_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Live.DeploymentGroups.Show':handle_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_progress/3"
}
],
"repo": "https://github.com/nerves-hub/nerves_hub_web",
"vendor": "nerves-hub",
"versions": [
{
"lessThan": "2.5.3",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
} nerves-hub/nerves_hub_web https://github.com
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'",
"'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab'",
"'Elixir.NervesHubWeb.Live.DeploymentGroups.Show'",
"'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary'"
],
"packageName": "nerves-hub/nerves_hub_web",
"packageURL": "pkg:github/nerves-hub/nerves_hub_web",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/components/device_page/settings_tab.ex",
"lib/nerves_hub_web/components/device_page/details_tab.ex",
"lib/nerves_hub_web/live/deployment_groups/show.ex",
"lib/nerves_hub_web/components/deployment_group_page/summary.ex"
],
"programRoutines": [
{
"name": "'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':handle_progress/3"
},
{
"name": "'Elixir.NervesHubWeb.Components.DevicePage.DetailsTab':hooked_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Live.DeploymentGroups.Show':handle_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary':handle_progress/3"
}
],
"repo": "https://github.com/nerves-hub/nerves_hub_web",
"vendor": "nerves-hub",
"versions": [
{
"lessThan": "34ea112472a460319c1e1dec8ad0ffc37df05ffe",
"status": "affected",
"version": "7b511764a468bb2c1f33945874faa86af2255c0c",
"versionType": "git"
}
]
} Original source record · Cite this exact observation · Complete original publisher JSON