{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://ghcr.io",
          "cpes": [
            "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NervesHubWeb.Live.Devices.Index\u0027",
            "\u0027Elixir.NervesHub.Products\u0027",
            "\u0027Elixir.NervesHubWeb.Components.BulkActionsSidebar\u0027"
          ],
          "packageName": "nerves-hub/nerves-hub",
          "packageURL": "pkg:oci/nerves-hub?repository_url=ghcr.io%2Fnerves-hub",
          "product": "nerves_hub_web",
          "programFiles": [
            "lib/nerves_hub_web/live/devices/index.ex",
            "lib/nerves_hub/products.ex",
            "lib/nerves_hub_web/components/bulk_actions_sidebar.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NervesHubWeb.Live.Devices.Index\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHub.Products\u0027:get_by_id/2"
            }
          ],
          "vendor": "nerves-hub",
          "versions": [
            {
              "lessThan": "2.5.3",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "other"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NervesHubWeb.Live.Devices.Index\u0027",
            "\u0027Elixir.NervesHub.Products\u0027",
            "\u0027Elixir.NervesHubWeb.Components.BulkActionsSidebar\u0027"
          ],
          "packageName": "nerves_hub",
          "packageURL": "pkg:otp/nerves_hub?repository_url=https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web\u0026vcs_url=git%20https:%2F%2Fgithub.com%2Fnerves-hub%2Fnerves_hub_web.git",
          "product": "nerves_hub_web",
          "programFiles": [
            "lib/nerves_hub_web/live/devices/index.ex",
            "lib/nerves_hub/products.ex",
            "lib/nerves_hub_web/components/bulk_actions_sidebar.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NervesHubWeb.Live.Devices.Index\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHub.Products\u0027:get_by_id/2"
            }
          ],
          "repo": "https://github.com/nerves-hub/nerves_hub_web",
          "vendor": "nerves-hub",
          "versions": [
            {
              "lessThan": "2.5.3",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.NervesHubWeb.Live.Devices.Index\u0027",
            "\u0027Elixir.NervesHub.Products\u0027",
            "\u0027Elixir.NervesHubWeb.Components.BulkActionsSidebar\u0027"
          ],
          "packageName": "nerves-hub/nerves_hub_web",
          "packageURL": "pkg:github/nerves-hub/nerves_hub_web",
          "product": "nerves_hub_web",
          "programFiles": [
            "lib/nerves_hub_web/live/devices/index.ex",
            "lib/nerves_hub/products.ex",
            "lib/nerves_hub_web/components/bulk_actions_sidebar.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.NervesHubWeb.Live.Devices.Index\u0027:handle_event/3"
            },
            {
              "name": "\u0027Elixir.NervesHub.Products\u0027:get_by_id/2"
            }
          ],
          "repo": "https://github.com/nerves-hub/nerves_hub_web",
          "vendor": "nerves-hub",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "adaeefdb7a835525482588f43332ef988cc448c7",
              "versionType": "git"
            },
            {
              "lessThan": "1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa",
              "status": "affected",
              "version": "79743ef08f7f801617b653fd09f37c01ed9b4be0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.5.3",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "arbor-s"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "arbor-s"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Josh Kalderimis"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "dateAssigned": "2026-11-09T22:35:49.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIncorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the \u003ccode\u003emanage\u003c/code\u003e role in one organization and only the \u003ccode\u003eview\u003c/code\u003e role in another to move devices into the second organization\u0027s product via the \"Move device(s) to product\" action. The \u003ccode\u003etarget-product\u003c/code\u003e event in \u003ccode\u003eNervesHubWeb.Live.Devices.Index\u003c/code\u003e looks the product up with \u003ccode\u003eNervesHub.Products.get_by_id/2\u003c/code\u003e, which checks that the user is a member of the product\u0027s organization at any role, and \u003ccode\u003emove-devices-product\u003c/code\u003e then changes each selected device\u0027s organization and product. The device API\u0027s move requires \u003ccode\u003emanage\u003c/code\u003e in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter.\u003c/p\u003e\n\u003cp\u003eA moved device keeps its key and certificate, joins the target organization\u0027s matching deployment groups, and is sent their firmware with a download URL, which the \u003ccode\u003eview\u003c/code\u003e role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization.\u003c/p\u003e\n\u003cp\u003eThis issue affects nerves_hub: from 1.0.0 before 2.5.3.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the `manage` role in one organization and only the `view` role in another to move devices into the second organization\u0027s product via the \"Move device(s) to product\" action. The `target-product` event in `NervesHubWeb.Live.Devices.Index` looks the product up with `NervesHub.Products.get_by_id/2`, which checks that the user is a member of the product\u0027s organization at any role, and `move-devices-product` then changes each selected device\u0027s organization and product. The device API\u0027s move requires `manage` in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter.\n\nA moved device keeps its key and certificate, joins the target organization\u0027s matching deployment groups, and is sent their firmware with a download URL, which the `view` role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."
            }
          ],
          "value": "Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization\u0027s product via the \"Move device(s) to product\" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product\u0027s organization at any role, and move-devices-product then changes each selected device\u0027s organization and product. The device API\u0027s move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter.\n\nA moved device keeps its key and certificate, joins the target organization\u0027s matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-122",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eA user who manages devices in one organization and holds only the view role in another can move their own devices into the second organization. The devices join its matching deployment groups and receive its firmware, which the view role cannot otherwise download, and they report health, logs and alarms into that organization. Devices already belonging to the other organization are not affected.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "A user who manages devices in one organization and holds only the view role in another can move their own devices into the second organization. The devices join its matching deployment groups and receive its firmware, which the view role cannot otherwise download, and they report health, logs and alarms into that organization. Devices already belonging to the other organization are not affected."
                }
              ],
              "value": "A user who manages devices in one organization and holds only the view role in another can move their own devices into the second organization. The devices join its matching deployment groups and receive its firmware, which the view role cannot otherwise download, and they report health, logs and alarms into that organization. Devices already belonging to the other organization are not affected."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T10:43:26.342Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "Users with the \u2018view\u2019 role in an organization can move devices into it and receive its firmware",
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-2j7r-q3vm-8j34"
        },
        {
          "name": "EEF CNA record for CVE-2026-120295",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-120295.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-120295",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-120295"
        },
        {
          "name": "Introducing commit adaeefd in nerves-hub/nerves_hub_web",
          "tags": [
            "related"
          ],
          "url": "https://github.com/nerves-hub/nerves_hub_web/commit/adaeefdb7a835525482588f43332ef988cc448c7"
        },
        {
          "name": "Introducing commit 79743ef in nerves-hub/nerves_hub_web",
          "tags": [
            "related"
          ],
          "url": "https://github.com/nerves-hub/nerves_hub_web/commit/79743ef08f7f801617b653fd09f37c01ed9b4be0"
        },
        {
          "name": "Fix commit 1bc8be8 in nerves-hub/nerves_hub_web",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/nerves-hub/nerves_hub_web/commit/1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eEvery move is recorded in the target product\u0027s audit log as \"User  moved device  to  : \u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Every move is recorded in the target product\u0027s audit log as \"User \u003cname\u003e moved device \u003cidentifier\u003e to \u003corg\u003e : \u003cproduct\u003e\". After upgrading, review the `audit_logs` rows with resource type `NervesHub.Products.Product` and a description containing \"moved device\" whose actor does not hold the `manage` or `admin` role in that organization, and move or remove the devices they brought in. Roles may have changed since a move, and entries older than the retention period are gone when `TRUNCATE_AUDIT_LOGS_ENABLED` is on."
            }
          ],
          "value": "Every move is recorded in the target product\u0027s audit log as \"User  moved device  to  : \". After upgrading, review the audit_logs rows with resource type NervesHub.Products.Product and a description containing \"moved device\" whose actor does not hold the manage or admin role in that organization, and move or remove the devices they brought in. Roles may have changed since a move, and entries older than the retention period are gone when TRUNCATE_AUDIT_LOGS_ENABLED is on."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware",
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAs a user with \u003ccode\u003emanage\u003c/code\u003e in organization A and \u003ccode\u003eview\u003c/code\u003e in organization B, where B has an active deployment group:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eOn A\u0027s devices page, give a device you control the tags B\u0027s deployment group asks for. A \u003ccode\u003eview\u003c/code\u003e member can see the group\u0027s conditions.\u003c/li\u003e\n\u003cli\u003eSelect the device, choose B\u0027s product under \"Move device(s) to product\" and press Move. The page reports the move as successful, and the device is now in B\u0027s product.\u003c/li\u003e\n\u003cli\u003eConnect the device, reporting the platform and architecture of the group\u0027s firmware. It joins the group and is sent B\u0027s firmware with a download URL.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "As a user with `manage` in organization A and `view` in organization B, where B has an active deployment group:\n\n1. On A\u0027s devices page, give a device you control the tags B\u0027s deployment group asks for. A `view` member can see the group\u0027s conditions.\n2. Select the device, choose B\u0027s product under \"Move device(s) to product\" and press Move. The page reports the move as successful, and the device is now in B\u0027s product.\n3. Connect the device, reporting the platform and architecture of the group\u0027s firmware. It joins the group and is sent B\u0027s firmware with a download URL."
            }
          ],
          "value": "As a user with manage in organization A and view in organization B, where B has an active deployment group:\n\n* On A\u0027s devices page, give a device you control the tags B\u0027s deployment group asks for. A view member can see the group\u0027s conditions.\n* Select the device, choose B\u0027s product under \"Move device(s) to product\" and press Move. The page reports the move as successful, and the device is now in B\u0027s product.\n* Connect the device, reporting the platform and architecture of the group\u0027s firmware. It joins the group and is sent B\u0027s firmware with a download URL."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003e1. Target selection.\u003c/strong\u003e The bulk actions sidebar (\u003ccode\u003eNervesHubWeb.Components.BulkActionsSidebar\u003c/code\u003e) lists the products of every organization in \u003ccode\u003ecurrent_scope.user.orgs\u003c/code\u003e. Choosing one sends \u003ccode\u003etarget-product\u003c/code\u003e to \u003ccode\u003eNervesHubWeb.Live.Devices.Index\u003c/code\u003e, which requires \u003ccode\u003edevice:update\u003c/code\u003e in the current organization and then calls \u003ccode\u003eNervesHub.Products.get_by_id/2\u003c/code\u003e. That query joins the product\u0027s organization to its \u003ccode\u003eorg_users\u003c/code\u003e rows and filters on the user\u0027s id only, so any membership in the target organization satisfies it, including the \u003ccode\u003eview\u003c/code\u003e role.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. The move.\u003c/strong\u003e \u003ccode\u003emove-devices-product\u003c/code\u003e passes the selected devices, or every device matching the current filter, to \u003ccode\u003eNervesHub.Devices.BulkActions.move_many/3\u003c/code\u003e, which calls \u003ccode\u003eDevices.move/3\u003c/code\u003e for each one and rewrites its \u003ccode\u003eorg_id\u003c/code\u003e and \u003ccode\u003eproduct_id\u003c/code\u003e. No check of the user\u0027s role in the target organization happens on this path, while the API\u0027s move in \u003ccode\u003eNervesHubWeb.API.DeviceController\u003c/code\u003e requires \u003ccode\u003emanage\u003c/code\u003e there.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Effect.\u003c/strong\u003e The moved device still authenticates with its own certificate. On its next connection it is matched against the target product\u0027s deployment groups by platform, architecture and tags, joins one, and is sent that group\u0027s firmware with a download URL.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "**1. Target selection.** The bulk actions sidebar (`NervesHubWeb.Components.BulkActionsSidebar`) lists the products of every organization in `current_scope.user.orgs`. Choosing one sends `target-product` to `NervesHubWeb.Live.Devices.Index`, which requires `device:update` in the current organization and then calls `NervesHub.Products.get_by_id/2`. That query joins the product\u0027s organization to its `org_users` rows and filters on the user\u0027s id only, so any membership in the target organization satisfies it, including the `view` role.\n\n**2. The move.** `move-devices-product` passes the selected devices, or every device matching the current filter, to `NervesHub.Devices.BulkActions.move_many/3`, which calls `Devices.move/3` for each one and rewrites its `org_id` and `product_id`. No check of the user\u0027s role in the target organization happens on this path, while the API\u0027s move in `NervesHubWeb.API.DeviceController` requires `manage` there.\n\n**3. Effect.** The moved device still authenticates with its own certificate. On its next connection it is matched against the target product\u0027s deployment groups by platform, architecture and tags, joins one, and is sent that group\u0027s firmware with a download URL."
            }
          ],
          "value": "1. Target selection. The bulk actions sidebar (NervesHubWeb.Components.BulkActionsSidebar) lists the products of every organization in current_scope.user.orgs. Choosing one sends target-product to NervesHubWeb.Live.Devices.Index, which requires device:update in the current organization and then calls NervesHub.Products.get_by_id/2. That query joins the product\u0027s organization to its org_users rows and filters on the user\u0027s id only, so any membership in the target organization satisfies it, including the view role.\n\n2. The move. move-devices-product passes the selected devices, or every device matching the current filter, to NervesHub.Devices.BulkActions.move_many/3, which calls Devices.move/3 for each one and rewrites its org_id and product_id. No check of the user\u0027s role in the target organization happens on this path, while the API\u0027s move in NervesHubWeb.API.DeviceController requires manage there.\n\n3. Effect. The moved device still authenticates with its own certificate. On its next connection it is matched against the target product\u0027s deployment groups by platform, architecture and tags, joins one, and is sent that group\u0027s firmware with a download URL."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-120295",
    "datePublished": "2026-11-10T10:43:26.342Z",
    "dateReserved": "2026-11-06T09:58:06.998Z",
    "dateUpdated": "2026-11-10T10:43:26.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}