{"id":"CVE-2026-120997","kind":"vulnerability","aliases":["CVE-2026-120997"],"related":[],"title":"NervesHub: removed members keep old access through open dashboard and device consoles","description":"Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member's role once when a page mounts, in the assign_org_to_scope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.\n\nThe dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user's id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session's LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user's current membership, until it expires.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3.","summary":"NervesHub's web app does not end a removed or downgraded organization member's open dashboard pages, device consoles, or shell channels, and console tokens stay valid for 24 hours after sign-out. A former member can keep running actions and commands on devices they no longer have rights to.","severity":"low","cvss":2.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elixir","iot","nerves_hub","package","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":"- Check the installed `nerves_hub` version in your `mix.lock` or release; versions from `1.0.0` before `2.5.3` are affected.\n- Review whether any organization members were removed or had roles lowered recently and whether their sessions were still active.","fix":"- `nerves_hub` moves to `2.5.3` or later (from the product range: fixed in `2.5.3`).","status":"open","published_at":"2026-11-10T11:16:42+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","triaged_at":"2026-11-10T11:22:07+00:00","updated_at":"2026-11-10T11:22:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T11:22:07Z","model":"claude-haiku-5-5","output":{"fix":"- `nerves_hub` moves to `2.5.3` or later (from the product range: fixed in `2.5.3`).","reach":"network","title":"NervesHub: removed members keep old access through open dashboard and device consoles","impact":"medium","summary":"NervesHub's web app does not end a removed or downgraded organization member's open dashboard pages, device consoles, or shell channels, and console tokens stay valid for 24 hours after sign-out. A former member can keep running actions and commands on devices they no longer have rights to.","audience":"businesses","category":"package","nicknames":[],"who_cares":["nerves_hub","self-hosted","elixir","iot"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"former member runs commands on devices they lost rights to","analyst_note":"","how_to_check":"- Check the installed `nerves_hub` version in your `mix.lock` or release; versions from `1.0.0` before `2.5.3` are affected.\n- Review whether any organization members were removed or had roles lowered recently and whether their sessions were still active.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting"],"who_is_affected":"Teams that self-host NervesHub and manage IoT devices through its web dashboard, console, or local shell channels. Exposure depends on members who were removed or downgraded while still holding open sessions or tokens. Teams using only the hosted service or without multi-member organizations can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000764,"input_tokens":4835,"output_tokens":560,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-120997':15A,18A '-2026':14A,17A '1.0.0':261C '2.5.3':263C '24':55B,216C 'accept':214C 'access':6A 'act':112C 'action':67B,178C 'affect':257C 'allow':98C 'also':198C 'anyth':118C 'app':30B 'assign':139C 'carri':176C 'chang':165C 'channel':48B,90C,155C 'check':156C 'command':69B,184C 'consol':12A,45B,50B,86C,148C,181C,200C,242C 'current':250C 'cve':13A,16A 'dashboard':9A,42B,83C,126C,197C 'devic':11A,44B,71B,85C,152C,187C 'disconnect':195C,226C 'downgrad':37B 'elixir':19B 'end':33B 'event':153C 'expir':254C 'former':62B 'given':106C 'hold':207C,233C 'hook':143C 'host':26B 'hour':56B,217C 'hub':22B,94C,96C,259C 'id':212C 'improp':77C 'invalid':79C 'iot':20B 'issu':256C 'join':160C 'keep':4A,65B,111C,175C,182C 'liveview':231C 'local':88C,149C 'longer':74B 'lower':108C 'member':3A,39B,63B,101C,129C,163C 'membership':157C,251C 'mount':136C 'nerv':21B,93C,95C,258C 'nerves-hub':92C 'nerveshub':1A,27B 'nerveshubweb.auth':145C 'nerveshubweb.usersocket':202C 'none':169C 'old':5A,115C 'open':8A,41B,121C,173C,180C,199C,241C 'org':140C 'organ':38B,100C 'packag':23B 'page':43B,84C,135C,174C,190C,239C 'read':127C 'reload':191C 'remov':2A,35B,104C,161C 'revok':221C 'right':76B 'role':109C,116C,131C,167C 'run':66B,183C 'scope':142C 'self':25B 'self-host':24B 'session':78C,229C 'shell':47B,89C,150C 'sign':59B,223C 'sign-out':58B 'socket':194C 'stay':52B 'stream':154C 'taken':236C 'tell':168C 'time':124C 'token':51B,205C,235C 'user':210C,245C,248C 'valid':53B 'vulner':80C 'web':29B,97C 'whoever':232C 'within':246C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host NervesHub and manage IoT devices through its web dashboard, console, or local shell channels. Exposure depends on members who were removed or downgraded while still holding open sessions or tokens. Teams using only the hosted service or without multi-member organizations can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["elixir","iot","low","nerveshub","package","selfhosted"],"campaign_type":null,"search_a":"'-120997':15A,18A '-2026':14A,17A 'access':6A 'consol':12A 'cve':13A,16A 'dashboard':9A 'devic':11A 'keep':4A 'member':3A 'nerveshub':1A 'old':5A 'open':8A 'remov':2A","search_b":"'24':55B 'action':67B 'app':30B 'channel':48B 'command':69B 'consol':45B,50B 'dashboard':42B 'devic':44B,71B 'downgrad':37B 'elixir':19B 'end':33B 'former':62B 'host':26B 'hour':56B 'hub':22B 'iot':20B 'keep':65B 'longer':74B 'member':39B,63B 'nerv':21B 'nerveshub':27B 'open':41B 'organ':38B 'packag':23B 'page':43B 'remov':35B 'right':76B 'run':66B 'self':25B 'self-host':24B 'shell':47B 'sign':59B 'sign-out':58B 'stay':52B 'token':51B 'valid':53B 'web':29B","search_c":"'1.0.0':261C '2.5.3':263C '24':216C 'accept':214C 'act':112C 'action':178C 'affect':257C 'allow':98C 'also':198C 'anyth':118C 'assign':139C 'carri':176C 'chang':165C 'channel':90C,155C 'check':156C 'command':184C 'consol':86C,148C,181C,200C,242C 'current':250C 'dashboard':83C,126C,197C 'devic':85C,152C,187C 'disconnect':195C,226C 'event':153C 'expir':254C 'given':106C 'hold':207C,233C 'hook':143C 'hour':217C 'hub':94C,96C,259C 'id':212C 'improp':77C 'invalid':79C 'issu':256C 'join':160C 'keep':111C,175C,182C 'liveview':231C 'local':88C,149C 'lower':108C 'member':101C,129C,163C 'membership':157C,251C 'mount':136C 'nerv':93C,95C,258C 'nerves-hub':92C 'nerveshubweb.auth':145C 'nerveshubweb.usersocket':202C 'none':169C 'old':115C 'open':121C,173C,180C,199C,241C 'org':140C 'organ':100C 'page':84C,135C,174C,190C,239C 'read':127C 'reload':191C 'remov':104C,161C 'revok':221C 'role':109C,116C,131C,167C 'run':183C 'scope':142C 'session':78C,229C 'shell':89C,150C 'sign':223C 'socket':194C 'stream':154C 'taken':236C 'tell':168C 'time':124C 'token':205C,235C 'user':210C,245C,248C 'vulner':80C 'web':97C 'whoever':232C 'within':246C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T10:39:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120997","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120997","severity":null,"published_at":"2026-11-10T11:16:42+00:00","modified_at":"2026-11-10T11:16:42+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","fetched_at":"2026-11-10T11:21:35+00:00","note":null}],"documents":[{"id":114619,"url":"https://github.com/nerves-hub/nerves_hub_web/commit/a96497ddd4d24ab1847f7685e255bf96fd87b85b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":114620,"url":"https://github.com/nerves-hub/nerves_hub_web/commit/b5d2438677f79d10e91aeef20a7b5cd8cca0d63c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":114621,"url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-c7jf-qcx9-xxf8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-10T10:39:47+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}