{"id":"CVE-2026-120286","kind":"vulnerability","aliases":["CVE-2026-120286"],"related":[],"title":"nerves_hub_web: view-role members can change devices and deployment groups","description":"Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member.\n\nA view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3.","summary":"Members with only the view role in nerves_hub_web can run LiveView events meant for the manage role, including adding device certificates, changing tags and deployment groups, and importing devices. A view member could add a certificate that lets its key holder connect as a device, or delete a device's certificate, but only within organizations they already belong to.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elixir","firmware-updates","nerves-hub","package","self-hosted"],"not_affected_if":["managed-hosting","no-view-role-members"],"how_to_check":"- Check the `nerves_hub` version in `mix.lock` or `mix.exs`; affected releases are from `1.0.0` before `2.5.3`.\n- Review which users hold the view role in your organizations; any view member can exercise this.","fix":"- `nerves_hub`: move to `2.5.3` or later.","status":"open","published_at":"2026-11-10T11:16:41+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","triaged_at":"2026-11-10T11:22:06+00:00","updated_at":"2026-11-10T11:22:06+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T11:22:06Z","model":"claude-haiku-5-5","output":{"fix":"- `nerves_hub`: move to `2.5.3` or later.","reach":"network","title":"nerves_hub_web: view-role members can change devices and deployment groups","impact":"medium","summary":"Members with only the view role in nerves_hub_web can run LiveView events meant for the manage role, including adding device certificates, changing tags and deployment groups, and importing devices. A view member could add a certificate that lets its key holder connect as a device, or delete a device's certificate, but only within organizations they already belong to.","audience":"developers","category":"package","nicknames":[],"who_cares":["nerves-hub","elixir","self-hosted","firmware-updates"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"View-role member adds certificates and reassigns devices to other firmware releases","analyst_note":"unknown","how_to_check":"- Check the `nerves_hub` version in `mix.lock` or `mix.exs`; affected releases are from `1.0.0` before `2.5.3`.\n- Review which users hold the view role in your organizations; any view member can exercise this.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-view-role-members","managed-hosting"],"who_is_affected":"Teams that run a self-hosted NervesHub server and have members with only the view role in an organization. Exposure depends on that organization role; a fleet managed without view-only members is less exposed, though the sources do not say how far that reduces risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000752,"input_tokens":4806,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120286':16A,19A '-2026':15A,18A '/2':190C '1.0.0':257C '2.5.3':259C 'add':51B,66B,135C,140C,204C 'affect':253C 'allow':108C 'alreadi':89B 'authent':110C,226C 'author':92C,189C 'belong':90B,249C 'build':182C 'call':188C 'carri':183C 'certif':53B,68B,83B,139C,206C,219C 'chang':9A,54B,118C,186C,230C 'clear':146C 'connect':74B,213C 'control':196C 'could':65B 'csv':174C 'cve':14A,17A 'delet':79B,137C,179C,217C 'delta':181C 'deploy':12A,57B,98C,121C,157C,164C,232C 'devic':10A,52B,61B,77B,81B,96C,119C,138C,148C,154C,161C,171C,216C,222C,240C 'elixir':20B 'event':44B,125C,132C 'everi':198C 'everyth':242C 'firmwar':22B,180C,237C 'firmware-upd':21B 'group':13A,58B,99C,122C,158C,165C,233C 'handler':133C 'hold':210C 'holder':73B 'host':30B 'hub':2A,26B,39B,104C,106C,255C 'import':60B,170C 'includ':50B 'issu':252C 'key':72B,212C 'let':70B,208C 'liveview':43B,124C 'locat':151C 'longer':225C 'manag':48B,129C 'manual':150C 'match':160C 'meant':45B 'member':7A,31B,64B,112C,199C,202C,248C 'miss':91C 'move':159C 'nerv':1A,25B,38B,103C,105C,254C 'nerves-hub':24B,102C 'one':169C 'organ':87B,111C,246C 'overwrit':144C 'packag':27B 'page':100C,193C 'receiv':241C 'releas':238C 'remov':142C,152C,167C 'render':194C 'reserv':126C 'retri':177C 'role':6A,36B,49B,116C,130C 'run':42B 'self':29B 'self-host':28B 'start':176C 'stay':243C 'tag':55B,143C 'unmatch':168C 'updat':23B 'via':123C 'view':5A,35B,63B,115C,201C 'view-rol':4A 'vulner':93C 'web':3A,40B,107C 'whoever':209C 'within':86B,244C 'without':187C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted NervesHub server and have members with only the view role in an organization. Exposure depends on that organization role; a fleet managed without view-only members is less exposed, though the sources do not say how far that reduces risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elixir","firmwareupdates","medium","nerveshub","package","selfhosted"],"campaign_type":null,"search_a":"'-120286':16A,19A '-2026':15A,18A 'chang':9A 'cve':14A,17A 'deploy':12A 'devic':10A 'group':13A 'hub':2A 'member':7A 'nerv':1A 'role':6A 'view':5A 'view-rol':4A 'web':3A","search_b":"'add':51B,66B 'alreadi':89B 'belong':90B 'certif':53B,68B,83B 'chang':54B 'connect':74B 'could':65B 'delet':79B 'deploy':57B 'devic':52B,61B,77B,81B 'elixir':20B 'event':44B 'firmwar':22B 'firmware-upd':21B 'group':58B 'holder':73B 'host':30B 'hub':26B,39B 'import':60B 'includ':50B 'key':72B 'let':70B 'liveview':43B 'manag':48B 'meant':45B 'member':31B,64B 'nerv':25B,38B 'nerves-hub':24B 'organ':87B 'packag':27B 'role':36B,49B 'run':42B 'self':29B 'self-host':28B 'tag':55B 'updat':23B 'view':35B,63B 'web':40B 'within':86B","search_c":"'/2':190C '1.0.0':257C '2.5.3':259C 'add':135C,140C,204C 'affect':253C 'allow':108C 'authent':110C,226C 'author':92C,189C 'belong':249C 'build':182C 'call':188C 'carri':183C 'certif':139C,206C,219C 'chang':118C,186C,230C 'clear':146C 'connect':213C 'control':196C 'csv':174C 'delet':137C,179C,217C 'delta':181C 'deploy':98C,121C,157C,164C,232C 'devic':96C,119C,138C,148C,154C,161C,171C,216C,222C,240C 'event':125C,132C 'everi':198C 'everyth':242C 'firmwar':180C,237C 'group':99C,122C,158C,165C,233C 'handler':133C 'hold':210C 'hub':104C,106C,255C 'import':170C 'issu':252C 'key':212C 'let':208C 'liveview':124C 'locat':151C 'longer':225C 'manag':129C 'manual':150C 'match':160C 'member':112C,199C,202C,248C 'miss':91C 'move':159C 'nerv':103C,105C,254C 'nerves-hub':102C 'one':169C 'organ':111C,246C 'overwrit':144C 'page':100C,193C 'receiv':241C 'releas':238C 'remov':142C,152C,167C 'render':194C 'reserv':126C 'retri':177C 'role':116C,130C 'start':176C 'stay':243C 'tag':143C 'unmatch':168C 'via':123C 'view':115C,201C 'vulner':93C 'web':107C 'whoever':209C 'within':244C 'without':187C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T10:38:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120286","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120286","severity":null,"published_at":"2026-11-10T11:16:41+00:00","modified_at":"2026-11-10T11:16:41+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","fetched_at":"2026-11-10T11:21:35+00:00","note":null}],"documents":[{"id":114609,"url":"https://github.com/nerves-hub/nerves_hub_web/commit/34ea112472a460319c1e1dec8ad0ffc37df05ffe","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":114610,"url":"https://github.com/nerves-hub/nerves_hub_web/commit/7b511764a468bb2c1f33945874faa86af2255c0c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":114611,"url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-gxj7-m8x6-r644","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T10:38:58+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}