{"id":"CVE-2026-120730","kind":"vulnerability","aliases":["CVE-2026-120730"],"related":[],"title":"NervesHub: authenticated users can write devices into other organizations","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one.\n\nA device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3.","summary":"NervesHub's device API and dashboard forms accept organization, product and deployment IDs from the request without checking ownership. A user who manages devices in their own organization can place devices into another organization's deployment group and have them receive that organization's firmware download URL.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elixir","firmware","iot","nerves-hub","nerves_hub","package","self-hosted"],"not_affected_if":["single-organization-trusted-users","version-2.5.3-or-later"],"how_to_check":"- Check the `nerves_hub` version in your deployment; it is affected from `1.0.0` before `2.5.3`.\n- Review whether any user accounts can create organizations and manage devices, since any account can create one.","fix":"- `nerves_hub` `2.5.3`","status":"open","published_at":"2026-11-10T11:16:42+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","triaged_at":"2026-11-10T11:21:58+00:00","updated_at":"2026-11-10T11:21:58+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-10T11:21:58Z","model":"claude-haiku-5-5","output":{"fix":"- `nerves_hub` `2.5.3`","reach":"internet","title":"NervesHub: authenticated users can write devices into other organizations","impact":"high","summary":"NervesHub's device API and dashboard forms accept organization, product and deployment IDs from the request without checking ownership. A user who manages devices in their own organization can place devices into another organization's deployment group and have them receive that organization's firmware download URL.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nerves-hub","nerves_hub","elixir","self-hosted","iot","firmware"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker pushes another organization's firmware to their devices","analyst_note":"Product ecosystem is hex; product_name not listed in the input, so the affected component is recorded as nerves_hub.Fix versions come from the NVD description.","how_to_check":"- Check the `nerves_hub` version in your deployment; it is affected from `1.0.0` before `2.5.3`.\n- Review whether any user accounts can create organizations and manage devices, since any account can create one.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2.5.3-or-later","single-organization-trusted-users"],"who_is_affected":"Self-hosted or managed NervesHub deployments running nerves_hub from 1.0.0 before 2.5.3 where users can sign up or hold the manage role in some organization. The flaw lets an authenticated user reach devices, products and deployments belonging to other organizations via submitted org_id, product_id and deployment_id fields. Deployments where only trusted staff hold accounts in a single organization have a much smaller exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000797,"input_tokens":4845,"output_tokens":625,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120730':12A,15A '-2026':11A,14A '/2,':150C '1.0.0':262C '2.5.3':264C 'accept':35B,189C 'account':208C 'action':137C 'affect':258C 'allow':106C 'alreadi':244C 'anoth':60B,216C 'api':31B,88C,133C 'attribut':83C 'authent':2A,108C 'belong':245C 'cannot':238C,251C 'cast':152C 'chang':239C 'changeset':188C 'check':45B 'control':76C,241C 'creat':134C,210C 'cve':10A,13A 'dashboard':33B,140C 'deploy':39B,63B,128C,156C,219C 'determin':81C 'devic':6A,30B,51B,58B,87C,89C,112C,132C,141C,213C,242C 'download':73B,234C 'dynam':80C 'dynamically-determin':79C 'elixir':16B 'field':130C 'firmwar':17B,72B,231C,253C 'form':34B,90C,95C,142C,168C 'given':162C 'group':64B,157C,220C 'host':27B 'hub':21B,23B,102C,104C,260C 'id':40B,124C,126C,129C,183C,192C 'improp':75C 'iot':18B 'issu':257C 'jitp':97C,187C 'key':92C,165C 'manag':50B,111C,197C 'merg':169C 'modif':77C 'move':222C 'nerv':20B,22B,101C,103C,259C 'nerves-hub':19B,100C 'nerveshub':1A,28B 'nerveshub.devices.device.changeset':149C 'nerveshub.devices.device.changeset/2,':148C 'object':82C 'one':211C 'org':123C,182C 'organ':9A,36B,55B,61B,70B,115C,120C,154C,173C,205C,217C,229C,249C 'ownership':46B 'packag':24B 'paramet':146C,177C 'pass':143C 'place':57B,214C 'product':37B,94C,125C,155C,167C,191C,225C 'receiv':68B 'request':43B,145C,194C 'requir':195C 'role':198C 'self':26B 'self-host':25B 'sent':227C 'session':171C 'set':98C 'sign':91C,164C 'state':160C 'submit':122C,176C,181C 'updat':136C,159C 'upload':252C 'url':74B,235C 'user':3A,48B,109C,202C,237C 'via':121C 'vulner':84C 'web':105C 'win':184C 'without':44B 'write':5A,117C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed NervesHub deployments running nerves_hub from 1.0.0 before 2.5.3 where users can sign up or hold the manage role in some organization. The flaw lets an authenticated user reach devices, products and deployments belonging to other organizations via submitted org_id, product_id and deployment_id fields. Deployments where only trusted staff hold accounts in a single organization have a much smaller exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elixir","firmware","high","iot","nerveshub","package","selfhosted"],"campaign_type":null,"search_a":"'-120730':12A,15A '-2026':11A,14A 'authent':2A 'cve':10A,13A 'devic':6A 'nerveshub':1A 'organ':9A 'user':3A 'write':5A","search_b":"'accept':35B 'anoth':60B 'api':31B 'check':45B 'dashboard':33B 'deploy':39B,63B 'devic':30B,51B,58B 'download':73B 'elixir':16B 'firmwar':17B,72B 'form':34B 'group':64B 'host':27B 'hub':21B,23B 'id':40B 'iot':18B 'manag':50B 'nerv':20B,22B 'nerves-hub':19B 'nerveshub':28B 'organ':36B,55B,61B,70B 'ownership':46B 'packag':24B 'place':57B 'product':37B 'receiv':68B 'request':43B 'self':26B 'self-host':25B 'url':74B 'user':48B 'without':44B","search_c":"'/2,':150C '1.0.0':262C '2.5.3':264C 'accept':189C 'account':208C 'action':137C 'affect':258C 'allow':106C 'alreadi':244C 'anoth':216C 'api':88C,133C 'attribut':83C 'authent':108C 'belong':245C 'cannot':238C,251C 'cast':152C 'chang':239C 'changeset':188C 'control':76C,241C 'creat':134C,210C 'dashboard':140C 'deploy':128C,156C,219C 'determin':81C 'devic':87C,89C,112C,132C,141C,213C,242C 'download':234C 'dynam':80C 'dynamically-determin':79C 'field':130C 'firmwar':231C,253C 'form':90C,95C,142C,168C 'given':162C 'group':157C,220C 'hub':102C,104C,260C 'id':124C,126C,129C,183C,192C 'improp':75C 'issu':257C 'jitp':97C,187C 'key':92C,165C 'manag':111C,197C 'merg':169C 'modif':77C 'move':222C 'nerv':101C,103C,259C 'nerves-hub':100C 'nerveshub.devices.device.changeset':149C 'nerveshub.devices.device.changeset/2,':148C 'object':82C 'one':211C 'org':123C,182C 'organ':115C,120C,154C,173C,205C,217C,229C,249C 'paramet':146C,177C 'pass':143C 'place':214C 'product':94C,125C,155C,167C,191C,225C 'request':145C,194C 'requir':195C 'role':198C 'sent':227C 'session':171C 'set':98C 'sign':91C,164C 'state':160C 'submit':122C,176C,181C 'updat':136C,159C 'upload':252C 'url':235C 'user':109C,202C,237C 'via':121C 'vulner':84C 'web':105C 'win':184C 'write':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T10:39:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120730","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120730","severity":null,"published_at":"2026-11-10T11:16:42+00:00","modified_at":"2026-11-10T11:16:42+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","fetched_at":"2026-11-10T11:21:35+00:00","note":null}],"documents":[{"id":114616,"url":"https://github.com/nerves-hub/nerves_hub_web/commit/c367d7d17d07f843e78a70d15904665616dde964","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":114617,"url":"https://github.com/nerves-hub/nerves_hub_web/commit/f58d58233dbd355c58d3a140107ece18e8863f14","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":114618,"url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-rpp7-x9hm-jrmr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T10:39:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}