Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120295— Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware

Quick assessment

Affected
nerves-hub nerves_hub_web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 nerves-hub 项目的 nerves_hub_web 模块中，设备页面的批量移动功能存在授权不当的漏洞。该漏洞允许拥有“管理（manage）”角色的用户在某个组织中，同时仅在另一个组织中拥有“查看（view）”角色时，通过“将设备移动到产品（Move device(s) to product）”操作，将设备移动到第二个组织的产品中。 具体而言，NervesHubWeb.Live.Devices.Index 中的 事件使用 函数查找目标产品，该函数仅检查用户是否以任意角色属于产品所属的组织。随后， 流程会更

CVSS 7.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120295

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware
Source: CVE Program / CVE List V5
Vulnerability Description
Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via the "Move device(s) to product" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product's organization at any role, and move-devices-product then changes each selected device's organization and product. The device API's move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter. A moved device keeps its key and certificate, joins the target organization's matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization. This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nerves-hub nerves_hub_web 1.0.0 ~ 2.5.3 cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
nerves-hub nerves_hub_web 1.0.0 ~ 2.5.3 cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
nerves-hub nerves_hub_web adaeefdb7a835525482588f43332ef988cc448c7 ~ * cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-120295

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120295

请登录查看更多情报信息。

Other References for CVE-2026-120295 (6)

Same Patch Batch · nerves-hub · 2026-11-10 · 6 CVEs total

CVE-2026-119446 9.4 CRITICAL Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user
CVE-2026-120730 8.6 HIGH Mass assignment of organization, product and deployment group IDs allows users to write in
CVE-2026-120999 7.4 HIGH Improper authentication lets Google sign-in and confirmation links sign users in to accoun
CVE-2026-120286 5.3 MEDIUM Missing authorization in device and deployment group page events allows view-role members
CVE-2026-120997 2.3 LOW Improper session invalidation keeps removed or demoted members' open pages and device cons

IV. Related Vulnerabilities

Same product: nerves_hub_web
Same vendor: nerves-hub
Same weakness: CWE-863