---
id: "CVE-2026-120997"
page: "https://infrastack.ai/live/CVE-2026-120997"
kind: "vulnerability"
aliases: ["CVE-2026-120997"]
title: "NervesHub: removed members keep old access through open dashboard and device consoles"
severity: "low"
cvss: 2.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elixir", "iot", "nerves_hub", "package", "self-hosted"]
not_affected_if: ["managed-hosting"]
published_at: "2026-11-10T11:16:42+00:00"
first_seen_at: "2026-11-10T11:21:35+00:00"
updated_at: "2026-11-10T11:22:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120997", "first_seen_at": "2026-11-10T11:21:35+00:00"}]
exploit_sources: []
---

# NervesHub: removed members keep old access through open dashboard and device consoles

Link for people: https://infrastack.ai/live/CVE-2026-120997 (this .md is for agents)

NervesHub's web app does not end a removed or downgraded organization member's open dashboard pages, device consoles, or shell channels, and console tokens stay valid for 24 hours after sign-out. A former member can keep running actions and commands on devices they no longer have rights to.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `nerves_hub` version in your `mix.lock` or release; versions from `1.0.0` before `2.5.3` are affected.
- Review whether any organization members were removed or had roles lowered recently and whether their sessions were still active.

## Fix

- `nerves_hub` moves to `2.5.3` or later (from the product range: fixed in `2.5.3`).

## Timeline

- 2026-11-10T11:21:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120997

## Documents

- [advisory] Vendor advisory: github.com https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-c7jf-qcx9-xxf8
- [fix] Patch: github.com https://github.com/nerves-hub/nerves_hub_web/commit/a96497ddd4d24ab1847f7685e255bf96fd87b85b
- [fix] Patch: github.com https://github.com/nerves-hub/nerves_hub_web/commit/b5d2438677f79d10e91aeef20a7b5cd8cca0d63c

## From the sources

Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member's role once when a page mounts, in the assign_org_to_scope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.

The dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user's id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session's LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user's current membership, until it expires.

This issue affects nerves_hub: from 1.0.0 before 2.5.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_