Security Advisory catalog CVE-2026-120730 Historical advisory recorded 10 Nov 2026 12:21:22 UTC. Read the latest advisory .
cve-program · CVE-2026-120730 Published
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one.
A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.
This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-120730 Published nerves-hub/nerves-hub https://ghcr.io
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"collectionURL": "https://ghcr.io",
"cpes": [
"cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.NervesHubWeb.API.DeviceController'",
"'Elixir.NervesHub.Devices.Device'",
"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'",
"'Elixir.NervesHubWeb.Live.Devices.New'",
"'Elixir.NervesHubWeb.Live.Org.SigningKeys'",
"'Elixir.NervesHubWeb.Live.Products.New'",
"'Elixir.NervesHub.Devices.CACertificate.JITP'",
"'Elixir.NervesHub.ManagedDeployments'"
],
"packageName": "nerves-hub/nerves-hub",
"packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/controllers/api/device_controller.ex",
"lib/nerves_hub/devices/device.ex",
"lib/nerves_hub_web/components/device_page/settings_tab.ex",
"lib/nerves_hub_web/live/devices/new.ex",
"lib/nerves_hub_web/live/org/signing_keys.ex",
"lib/nerves_hub_web/live/products/new.ex",
"lib/nerves_hub/devices/ca_certificate/jitp.ex",
"lib/nerves_hub/managed_deployments.ex"
],
"programRoutines": [
{
"name": "'Elixir.NervesHubWeb.API.DeviceController':create/2"
},
{
"name": "'Elixir.NervesHubWeb.API.DeviceController':update/2"
},
{
"name": "'Elixir.NervesHub.Devices.Device':changeset/2"
},
{
"name": "'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Live.Devices.New':handle_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Live.Org.SigningKeys':handle_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Live.Products.New':handle_event/3"
},
{
"name": "'Elixir.NervesHub.Devices.CACertificate.JITP':changeset/2"
}
],
"vendor": "nerves-hub",
"versions": [
{
"lessThan": "2.5.3",
"status": "affected",
"version": "1.0.0",
"versionType": "other"
}
]
} nerves_hub Vendor product
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"cpes": [
"cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.NervesHubWeb.API.DeviceController'",
"'Elixir.NervesHub.Devices.Device'",
"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'",
"'Elixir.NervesHubWeb.Live.Devices.New'",
"'Elixir.NervesHubWeb.Live.Org.SigningKeys'",
"'Elixir.NervesHubWeb.Live.Products.New'",
"'Elixir.NervesHub.Devices.CACertificate.JITP'",
"'Elixir.NervesHub.ManagedDeployments'"
],
"packageName": "nerves_hub",
"packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web&vcs_url=git%20https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/controllers/api/device_controller.ex",
"lib/nerves_hub/devices/device.ex",
"lib/nerves_hub_web/components/device_page/settings_tab.ex",
"lib/nerves_hub_web/live/devices/new.ex",
"lib/nerves_hub_web/live/org/signing_keys.ex",
"lib/nerves_hub_web/live/products/new.ex",
"lib/nerves_hub/devices/ca_certificate/jitp.ex",
"lib/nerves_hub/managed_deployments.ex"
],
"programRoutines": [
{
"name": "'Elixir.NervesHubWeb.API.DeviceController':create/2"
},
{
"name": "'Elixir.NervesHubWeb.API.DeviceController':update/2"
},
{
"name": "'Elixir.NervesHub.Devices.Device':changeset/2"
},
{
"name": "'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Live.Devices.New':handle_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Live.Org.SigningKeys':handle_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Live.Products.New':handle_event/3"
},
{
"name": "'Elixir.NervesHub.Devices.CACertificate.JITP':changeset/2"
}
],
"repo": "https://github.com/nerves-hub/nerves_hub_web",
"vendor": "nerves-hub",
"versions": [
{
"lessThan": "2.5.3",
"status": "affected",
"version": "1.0.0",
"versionType": "semver"
}
]
} nerves-hub/nerves_hub_web https://github.com
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"'Elixir.NervesHubWeb.API.DeviceController'",
"'Elixir.NervesHub.Devices.Device'",
"'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab'",
"'Elixir.NervesHubWeb.Live.Devices.New'",
"'Elixir.NervesHubWeb.Live.Org.SigningKeys'",
"'Elixir.NervesHubWeb.Live.Products.New'",
"'Elixir.NervesHub.Devices.CACertificate.JITP'",
"'Elixir.NervesHub.ManagedDeployments'"
],
"packageName": "nerves-hub/nerves_hub_web",
"packageURL": "pkg:github/nerves-hub/nerves_hub_web",
"product": "nerves_hub_web",
"programFiles": [
"lib/nerves_hub_web/controllers/api/device_controller.ex",
"lib/nerves_hub/devices/device.ex",
"lib/nerves_hub_web/components/device_page/settings_tab.ex",
"lib/nerves_hub_web/live/devices/new.ex",
"lib/nerves_hub_web/live/org/signing_keys.ex",
"lib/nerves_hub_web/live/products/new.ex",
"lib/nerves_hub/devices/ca_certificate/jitp.ex",
"lib/nerves_hub/managed_deployments.ex"
],
"programRoutines": [
{
"name": "'Elixir.NervesHubWeb.API.DeviceController':create/2"
},
{
"name": "'Elixir.NervesHubWeb.API.DeviceController':update/2"
},
{
"name": "'Elixir.NervesHub.Devices.Device':changeset/2"
},
{
"name": "'Elixir.NervesHubWeb.Components.DevicePage.SettingsTab':hooked_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Live.Devices.New':handle_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Live.Org.SigningKeys':handle_event/3"
},
{
"name": "'Elixir.NervesHubWeb.Live.Products.New':handle_event/3"
},
{
"name": "'Elixir.NervesHub.Devices.CACertificate.JITP':changeset/2"
}
],
"repo": "https://github.com/nerves-hub/nerves_hub_web",
"vendor": "nerves-hub",
"versions": [
{
"lessThan": "c367d7d17d07f843e78a70d15904665616dde964",
"status": "affected",
"version": "f58d58233dbd355c58d3a140107ece18e8863f14",
"versionType": "git"
}
]
} Original source record · Cite this exact observation · Complete original publisher JSON