CVE-2026-120286— 设备部署组事件缺失授权，允许成员修改
一分钟漏洞结论
影响对象
nerves-hub nerves_hub_web
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 nerves-hub 项目中，nerves_hub_web 的设备页面和部署组页面存在缺少授权（Missing Authorization）的漏洞。该漏洞允许拥有“查看（view）”角色的已认证组织成员，通过原本仅限“管理（manage）”角色使用的 LiveView 事件，对设备和部署组进行修改。 具体而言，以下事件处理器在执行操作时未调用 进行权限校验，且相关页面会向所有组织成员渲染操作控件： 添加或删除设备证书 添加或移除标签 覆盖或清除设备的手动位置信息 将设备从其部署组中移除 将匹配的设备移入部署组，
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-120286 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups
来源: CVE Program / CVE List V5
Vulnerability Description
Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member.
A view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to.
This issue affects nerves_hub: from 1.0.0 before 2.5.3.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| nerves-hub | nerves_hub_web | 1.0.0 ~ 2.5.3 |
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
|
|
| nerves-hub | nerves_hub_web | 1.0.0 ~ 2.5.3 |
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
|
|
| nerves-hub | nerves_hub_web | 7b511764a468bb2c1f33945874faa86af2255c0c ~ 34ea112472a460319c1e1dec8ad0ffc37df05ffe |
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
|
|
二、漏洞 CVE-2026-120286 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-120286 的情报信息
请登录查看更多情报信息。
CVE-2026-120286 其他参考 (5)
-
https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-gxj7-m8x6-r644 vendor-advisory related
同批安全公告 · nerves-hub · 2026-11-10 · 共 6 条
| CVE-2026-119446 | 9.4 CRITICAL | CLI 登录会话固定导致未授权获取 API 令牌漏洞 |
| CVE-2026-120730 | 8.6 HIGH | 组织、产品及部署组 ID 强制赋值漏洞 |
| CVE-2026-120999 | 7.4 HIGH | Google 身份验证不当导致账户接管漏洞 |
| CVE-2026-120295 | 7.1 HIGH | 设备批量移动功能权限绕过漏洞 |
| CVE-2026-120997 | 2.3 LOW | 会话失效不当致降权成员保留旧角色权限漏洞 |