{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://ghcr.io",
          "cpes": [
            "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027",
            "\u0027Elixir.NervesHubWeb.Components.DevicePage.DetailsTab\u0027",
            "\u0027Elixir.NervesHubWeb.Live.DeploymentGroups.Show\u0027",
            "\u0027Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary\u0027"
          ],
          "packageName": "nerves-hub/nerves-hub",
          "packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub",
          "product": "nerves_hub_web",
          "programFiles": [
            "lib/nerves_hub_web/components/device_page/settings_tab.ex",
            "lib/nerves_hub_web/components/device_page/details_tab.ex",
            "lib/nerves_hub_web/live/deployment_groups/show.ex",
            "lib/nerves_hub_web/components/deployment_group_page/summary.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027:hooked_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027:handle_progress/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DevicePage.DetailsTab\u0027:hooked_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Live.DeploymentGroups.Show\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary\u0027:handle_progress/3"
            }
          ],
          "vendor": "nerves-hub",
          "versions": [
            {
              "lessThan": "2.5.3",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "other"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027",
            "\u0027Elixir.NervesHubWeb.Components.DevicePage.DetailsTab\u0027",
            "\u0027Elixir.NervesHubWeb.Live.DeploymentGroups.Show\u0027",
            "\u0027Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary\u0027"
          ],
          "packageName": "nerves_hub",
          "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git",
          "product": "nerves_hub_web",
          "programFiles": [
            "lib/nerves_hub_web/components/device_page/settings_tab.ex",
            "lib/nerves_hub_web/components/device_page/details_tab.ex",
            "lib/nerves_hub_web/live/deployment_groups/show.ex",
            "lib/nerves_hub_web/components/deployment_group_page/summary.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027:hooked_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027:handle_progress/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DevicePage.DetailsTab\u0027:hooked_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Live.DeploymentGroups.Show\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary\u0027:handle_progress/3"
            }
          ],
          "repo": "https://github.com/nerves-hub/nerves_hub_web",
          "vendor": "nerves-hub",
          "versions": [
            {
              "lessThan": "2.5.3",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027",
            "\u0027Elixir.NervesHubWeb.Components.DevicePage.DetailsTab\u0027",
            "\u0027Elixir.NervesHubWeb.Live.DeploymentGroups.Show\u0027",
            "\u0027Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary\u0027"
          ],
          "packageName": "nerves-hub/nerves_hub_web",
          "packageURL": "pkg:github/nerves-hub/nerves_hub_web",
          "product": "nerves_hub_web",
          "programFiles": [
            "lib/nerves_hub_web/components/device_page/settings_tab.ex",
            "lib/nerves_hub_web/components/device_page/details_tab.ex",
            "lib/nerves_hub_web/live/deployment_groups/show.ex",
            "lib/nerves_hub_web/components/deployment_group_page/summary.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027:hooked_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DevicePage.SettingsTab\u0027:handle_progress/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DevicePage.DetailsTab\u0027:hooked_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Live.DeploymentGroups.Show\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHubWeb.Components.DeploymentGroupPage.Summary\u0027:handle_progress/3"
            }
          ],
          "repo": "https://github.com/nerves-hub/nerves_hub_web",
          "vendor": "nerves-hub",
          "versions": [
            {
              "lessThan": "34ea112472a460319c1e1dec8ad0ffc37df05ffe",
              "status": "affected",
              "version": "7b511764a468bb2c1f33945874faa86af2255c0c",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.5.3",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "arbor-s"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "arbor-s"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Josh Kalderimis"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-11-09T22:27:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the \u003ccode\u003eview\u003c/code\u003e role to change devices and deployment groups via LiveView events reserved for the \u003ccode\u003emanage\u003c/code\u003e role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device\u0027s manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling \u003ccode\u003eauthorized!/2\u003c/code\u003e, and the pages render the controls to every member.\u003c/p\u003e\n\u003cp\u003eA \u003ccode\u003eview\u003c/code\u003e member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to.\u003c/p\u003e\n\u003cp\u003eThis issue affects nerves_hub: from 1.0.0 before 2.5.3.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the `view` role to change devices and deployment groups via LiveView events reserved for the `manage` role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device\u0027s manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling `authorized!/2`, and the pages render the controls to every member.\n\nA `view` member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."
            }
          ],
          "value": "Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device\u0027s manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member.\n\nA view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn organization member with the view role can add or delete a device\u0027s certificates, change its tags and location, and move devices into or out of deployment groups, which changes the firmware release they receive. An added certificate lets whoever holds its key connect as the device and persists after the member leaves. Everything stays within the organizations the member belongs to.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An organization member with the view role can add or delete a device\u0027s certificates, change its tags and location, and move devices into or out of deployment groups, which changes the firmware release they receive. An added certificate lets whoever holds its key connect as the device and persists after the member leaves. Everything stays within the organizations the member belongs to."
                }
              ],
              "value": "An organization member with the view role can add or delete a device\u0027s certificates, change its tags and location, and move devices into or out of deployment groups, which changes the firmware release they receive. An added certificate lets whoever holds its key connect as the device and persists after the member leaves. Everything stays within the organizations the member belongs to."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T10:44:07.907Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "Users with the \u2018view\u2019 role can change devices and deployment groups and read local shell output",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-gxj7-m8x6-r644"
        },
        {
          "name": "EEF CNA record for CVE-2026-120286",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-120286.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-120286",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-120286"
        },
        {
          "name": "Introducing commit 7b51176 in nerves-hub/nerves_hub_web",
          "tags": [
            "related"
          ],
          "url": "https://github.com/nerves-hub/nerves_hub_web/commit/7b511764a468bb2c1f33945874faa86af2255c0c"
        },
        {
          "name": "Fix commit 34ea112 in nerves-hub/nerves_hub_web",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/nerves-hub/nerves_hub_web/commit/34ea112472a460319c1e1dec8ad0ffc37df05ffe"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrading does not remove a certificate that a \u003ccode\u003eview\u003c/code\u003e member already added. After upgrading, review each device\u0027s certificates and delete any you do not recognize.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Upgrading does not remove a certificate that a `view` member already added. After upgrading, review each device\u0027s certificates and delete any you do not recognize."
            }
          ],
          "value": "Upgrading does not remove a certificate that a view member already added. After upgrading, review each device\u0027s certificates and delete any you do not recognize."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNo configuration closes the hole. Until the upgrade, give the \u003ccode\u003eview\u003c/code\u003e role only to people you would trust with the \u003ccode\u003emanage\u003c/code\u003e role on that organization\u0027s devices.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "No configuration closes the hole. Until the upgrade, give the `view` role only to people you would trust with the `manage` role on that organization\u0027s devices."
            }
          ],
          "value": "No configuration closes the hole. Until the upgrade, give the view role only to people you would trust with the manage role on that organization\u0027s devices."
        }
      ],
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003col\u003e\n\u003cli\u003eCreate deployment group \u003ccode\u003ecanary\u003c/code\u003e with conditions matching tag \u003ccode\u003ebeta\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eCreate \u003ccode\u003edevice_outside_match\u003c/code\u003e in the same product with tag \u003ccode\u003ebeta\u003c/code\u003e and no deployment group, and \u003ccode\u003edevice_inside_mismatch\u003c/code\u003e in deployment group \u003ccode\u003ecanary\u003c/code\u003e with tag \u003ccode\u003efoo\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSign in as a member of the organization with the \u003ccode\u003eview\u003c/code\u003e role and open \u003ccode\u003e/org/\u0026lt;org\u0026gt;/\u0026lt;product\u0026gt;/deployment_groups/canary\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eClick \u003ccode\u003eMove device(s)\u003c/code\u003e: \u003ccode\u003edevice_outside_match\u003c/code\u003e is now in \u003ccode\u003ecanary\u003c/code\u003e. Click \u003ccode\u003eRemove device(s)\u003c/code\u003e: \u003ccode\u003edevice_inside_mismatch\u003c/code\u003e no longer has a deployment group.\u003c/li\u003e\n\u003cli\u003eAs the same member, open a device in the product and add a tag. The tag is saved.\u003c/li\u003e\n\u003cli\u003eOn the device\u0027s settings tab, delete a certificate, or upload a self-signed one. The change is saved, and a client presenting the uploaded certificate connects as the device.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "1. Create deployment group `canary` with conditions matching tag `beta`.\n2. Create `device_outside_match` in the same product with tag `beta` and no deployment group, and `device_inside_mismatch` in deployment group `canary` with tag `foo`.\n3. Sign in as a member of the organization with the `view` role and open `/org/\u003corg\u003e/\u003cproduct\u003e/deployment_groups/canary`.\n4. Click `Move device(s)`: `device_outside_match` is now in `canary`. Click `Remove device(s)`: `device_inside_mismatch` no longer has a deployment group.\n5. As the same member, open a device in the product and add a tag. The tag is saved.\n6. On the device\u0027s settings tab, delete a certificate, or upload a self-signed one. The change is saved, and a client presenting the uploaded certificate connects as the device."
            }
          ],
          "value": "* Create deployment group canary with conditions matching tag beta.\n* Create device_outside_match in the same product with tag beta and no deployment group, and device_inside_mismatch in deployment group canary with tag foo.\n* Sign in as a member of the organization with the view role and open /org/\u003corg\u003e/\u003cproduct\u003e/deployment_groups/canary.\n* Click Move device(s): device_outside_match is now in canary. Click Remove device(s): device_inside_mismatch no longer has a deployment group.\n* As the same member, open a device in the product and add a tag. The tag is saved.\n* On the device\u0027s settings tab, delete a certificate, or upload a self-signed one. The change is saved, and a client presenting the uploaded certificate connects as the device."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe dashboard reads the member\u0027s role into \u003ccode\u003ecurrent_scope\u003c/code\u003e when a page mounts, and each privileged event handler is expected to call \u003ccode\u003eauthorized!/2\u003c/code\u003e with the permission it needs, all of which resolve to the \u003ccode\u003emanage\u003c/code\u003e role in \u003ccode\u003elib/nerves_hub_web/helpers/authorization.ex\u003c/code\u003e. These handlers never do:\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eDevice settings tab\u003c/strong\u003e (\u003ccode\u003eNervesHubWeb.Components.DevicePage.SettingsTab\u003c/code\u003e): \u003ccode\u003ehooked_event/3\u003c/code\u003e for \u003ccode\u003edelete-certificate\u003c/code\u003e, and \u003ccode\u003ehandle_progress/3\u003c/code\u003e for the \u003ccode\u003ecertificate\u003c/code\u003e upload, which should require \u003ccode\u003edevice:update\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eDevice details tab\u003c/strong\u003e (\u003ccode\u003eNervesHubWeb.Components.DevicePage.DetailsTab\u003c/code\u003e): \u003ccode\u003ehooked_event/3\u003c/code\u003e for \u003ccode\u003eadd-tag\u003c/code\u003e, \u003ccode\u003eremove-tag\u003c/code\u003e, \u003ccode\u003esave-location-changes\u003c/code\u003e and \u003ccode\u003eclear-manual-location-information\u003c/code\u003e (\u003ccode\u003edevice:update\u003c/code\u003e), and \u003ccode\u003eremove-from-deployment-group\u003c/code\u003e (\u003ccode\u003edevice:set-deployment-group\u003c/code\u003e).\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eDeployment group page\u003c/strong\u003e (\u003ccode\u003eNervesHubWeb.Live.DeploymentGroups.Show\u003c/code\u003e and \u003ccode\u003eNervesHubWeb.Components.DeploymentGroupPage.Summary\u003c/code\u003e): \u003ccode\u003ehandle_event/3\u003c/code\u003e for \u003ccode\u003emove-matched-devices-to-deployment-group\u003c/code\u003e and \u003ccode\u003eremove-unmatched-devices-from-deployment-group\u003c/code\u003e, and \u003ccode\u003ehandle_progress/3\u003c/code\u003e for the \u003ccode\u003edevice_csv\u003c/code\u003e upload (\u003ccode\u003edevice:set-deployment-group\u003c/code\u003e), plus \u003ccode\u003egenerate-firmware-deltas\u003c/code\u003e, \u003ccode\u003eretry_delta\u003c/code\u003e and \u003ccode\u003edelete_delta\u003c/code\u003e (\u003ccode\u003edeployment_group:update\u003c/code\u003e).\u003c/p\u003e\n\u003cp\u003eThe pages show every one of these controls to \u003ccode\u003eview\u003c/code\u003e members, so each change takes a click, and a client can send the events directly over the LiveView socket regardless.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The dashboard reads the member\u0027s role into `current_scope` when a page mounts, and each privileged event handler is expected to call `authorized!/2` with the permission it needs, all of which resolve to the `manage` role in `lib/nerves_hub_web/helpers/authorization.ex`. These handlers never do:\n\n**Device settings tab** (`NervesHubWeb.Components.DevicePage.SettingsTab`): `hooked_event/3` for `delete-certificate`, and `handle_progress/3` for the `certificate` upload, which should require `device:update`.\n\n**Device details tab** (`NervesHubWeb.Components.DevicePage.DetailsTab`): `hooked_event/3` for `add-tag`, `remove-tag`, `save-location-changes` and `clear-manual-location-information` (`device:update`), and `remove-from-deployment-group` (`device:set-deployment-group`).\n\n**Deployment group page** (`NervesHubWeb.Live.DeploymentGroups.Show` and `NervesHubWeb.Components.DeploymentGroupPage.Summary`): `handle_event/3` for `move-matched-devices-to-deployment-group` and `remove-unmatched-devices-from-deployment-group`, and `handle_progress/3` for the `device_csv` upload (`device:set-deployment-group`), plus `generate-firmware-deltas`, `retry_delta` and `delete_delta` (`deployment_group:update`).\n\nThe pages show every one of these controls to `view` members, so each change takes a click, and a client can send the events directly over the LiveView socket regardless."
            }
          ],
          "value": "The dashboard reads the member\u0027s role into current_scope when a page mounts, and each privileged event handler is expected to call authorized!/2 with the permission it needs, all of which resolve to the manage role in lib/nerves_hub_web/helpers/authorization.ex. These handlers never do:\n\nDevice settings tab (NervesHubWeb.Components.DevicePage.SettingsTab): hooked_event/3 for delete-certificate, and handle_progress/3 for the certificate upload, which should require device:update.\n\nDevice details tab (NervesHubWeb.Components.DevicePage.DetailsTab): hooked_event/3 for add-tag, remove-tag, save-location-changes and clear-manual-location-information (device:update), and remove-from-deployment-group (device:set-deployment-group).\n\nDeployment group page (NervesHubWeb.Live.DeploymentGroups.Show and NervesHubWeb.Components.DeploymentGroupPage.Summary): handle_event/3 for move-matched-devices-to-deployment-group and remove-unmatched-devices-from-deployment-group, and handle_progress/3 for the device_csv upload (device:set-deployment-group), plus generate-firmware-deltas, retry_delta and delete_delta (deployment_group:update).\n\nThe pages show every one of these controls to view members, so each change takes a click, and a client can send the events directly over the LiveView socket regardless."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-120286",
    "datePublished": "2026-11-10T10:44:07.907Z",
    "dateReserved": "2026-11-04T17:15:01.545Z",
    "dateUpdated": "2026-11-10T10:44:07.907Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}