Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-120730— Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware

Quick assessment

Affected
nerves-hub nerves_hub_web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 nerves-hub 项目的 nerves_hub_web 模块中，存在一个“动态确定对象属性的不当修改”漏洞，影响范围包括设备 API、设备表单、签名密钥表单、产品表单以及 JITP（Just-In-Time Provisioning）设置。该漏洞允许任何拥有设备管理权限的已认证用户，通过提交伪造的 org_id、product_id 和 deployment_id 字段，将设备写入其他组织。 具体而言： 设备 API 的创建和更新操作，以及仪表板中的设备表单，会将请求参数直接传递给 函数，该函数会无条件地接

CVSS 8.6 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-120730

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware
Source: CVE Program / CVE List V5
Vulnerability Description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one. A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it. This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nerves-hub nerves_hub_web 1.0.0 ~ 2.5.3 cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
nerves-hub nerves_hub_web 1.0.0 ~ 2.5.3 cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
nerves-hub nerves_hub_web f58d58233dbd355c58d3a140107ece18e8863f14 ~ c367d7d17d07f843e78a70d15904665616dde964 cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-120730

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-120730

请登录查看更多情报信息。

Other References for CVE-2026-120730 (5)

Same Patch Batch · nerves-hub · 2026-11-10 · 6 CVEs total

CVE-2026-119446 9.4 CRITICAL Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user
CVE-2026-120999 7.4 HIGH Improper authentication lets Google sign-in and confirmation links sign users in to accoun
CVE-2026-120295 7.1 HIGH Incorrect authorization in the devices page bulk move allows view-role members to move dev
CVE-2026-120286 5.3 MEDIUM Missing authorization in device and deployment group page events allows view-role members
CVE-2026-120997 2.3 LOW Improper session invalidation keeps removed or demoted members' open pages and device cons

IV. Related Vulnerabilities

Same product: nerves_hub_web
Same vendor: nerves-hub
Same weakness: CWE-639