Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120286— Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups

Quick assessment

Affected
nerves-hub nerves_hub_web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 nerves-hub 项目中，nerves_hub_web 的设备页面和部署组页面存在缺少授权（Missing Authorization）的漏洞。该漏洞允许拥有“查看（view）”角色的已认证组织成员，通过原本仅限“管理（manage）”角色使用的 LiveView 事件，对设备和部署组进行修改。 具体而言，以下事件处理器在执行操作时未调用 进行权限校验，且相关页面会向所有组织成员渲染操作控件： 添加或删除设备证书 添加或移除标签 覆盖或清除设备的手动位置信息 将设备从其部署组中移除 将匹配的设备移入部署组，

CVSS 5.3 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120286

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member. A view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to. This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nerves-hub nerves_hub_web 1.0.0 ~ 2.5.3 cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
nerves-hub nerves_hub_web 1.0.0 ~ 2.5.3 cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
nerves-hub nerves_hub_web 7b511764a468bb2c1f33945874faa86af2255c0c ~ 34ea112472a460319c1e1dec8ad0ffc37df05ffe cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-120286

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120286

请登录查看更多情报信息。

Other References for CVE-2026-120286 (5)

Same Patch Batch · nerves-hub · 2026-11-10 · 6 CVEs total

CVE-2026-119446 9.4 CRITICAL Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user
CVE-2026-120730 8.6 HIGH Mass assignment of organization, product and deployment group IDs allows users to write in
CVE-2026-120999 7.4 HIGH Improper authentication lets Google sign-in and confirmation links sign users in to accoun
CVE-2026-120295 7.1 HIGH Incorrect authorization in the devices page bulk move allows view-role members to move dev
CVE-2026-120997 2.3 LOW Improper session invalidation keeps removed or demoted members' open pages and device cons

IV. Related Vulnerabilities

Same product: nerves_hub_web
Same vendor: nerves-hub
Same weakness: CWE-862