---
id: "CVE-2026-120730"
page: "https://infrastack.ai/live/CVE-2026-120730"
kind: "vulnerability"
aliases: ["CVE-2026-120730"]
title: "NervesHub: authenticated users can write devices into other organizations"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elixir", "firmware", "iot", "nerves-hub", "nerves_hub", "package", "self-hosted"]
not_affected_if: ["single-organization-trusted-users", "version-2.5.3-or-later"]
published_at: "2026-11-10T11:16:42+00:00"
first_seen_at: "2026-11-10T11:21:35+00:00"
updated_at: "2026-11-10T11:21:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120730", "first_seen_at": "2026-11-10T11:21:35+00:00"}]
exploit_sources: []
---

# NervesHub: authenticated users can write devices into other organizations

Link for people: https://infrastack.ai/live/CVE-2026-120730 (this .md is for agents)

NervesHub's device API and dashboard forms accept organization, product and deployment IDs from the request without checking ownership. A user who manages devices in their own organization can place devices into another organization's deployment group and have them receive that organization's firmware download URL.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the `nerves_hub` version in your deployment; it is affected from `1.0.0` before `2.5.3`.
- Review whether any user accounts can create organizations and manage devices, since any account can create one.

## Fix

- `nerves_hub` `2.5.3`

## Timeline

- 2026-11-10T11:21:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120730

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-rpp7-x9hm-jrmr
- [fix] Patch: github.com https://github.com/nerves-hub/nerves_hub_web/commit/c367d7d17d07f843e78a70d15904665616dde964
- [fix] Patch: github.com https://github.com/nerves-hub/nerves_hub_web/commit/f58d58233dbd355c58d3a140107ece18e8863f14

## From the sources

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one.

A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.

This issue affects nerves_hub: from 1.0.0 before 2.5.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_