CVE-2026-120286: Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups
Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerveshubweb allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member.
A view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to.
This issue affects nerveshub: from 1.0.0 before 2.5.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nerves_hubto a version that resolves this vulnerability.Fixed in 2.5.3 - Operational
After upgrading, review each device's certificates and delete any certificates you do not recognize, since upgrading does not remove certificates previously added by a view-role member.
Event History
Frequently Asked Questions
Which users can exploit this issue, and what access do they need?
Any authenticated member assigned the view role in an organization can trigger the affected LiveView events. The impact is limited to organizations of which that member is already a member.
Are view-only users exposed through the normal interface?
Yes. The affected device and deployment-group pages render the relevant controls to every organization member, and the corresponding event handlers do not enforce the manage-role authorization check.
What changes could a view-role member make?
They can add or delete device certificates, modify tags and manual locations, move devices into or out of deployment groups, import devices from CSV, and start, retry, or delete firmware delta builds. Moving a device between deployment groups can change the firmware release it receives.
How can this be remediated?
Upgrade nerves_hub to version 2.5.3 or later. Versions from 1.0.0 before 2.5.3 are affected.
What should be reviewed after discovering exposure?
Review actions by view-role members within their organizations for certificate additions or deletions, tag and location changes, deployment-group membership changes, CSV imports, and firmware delta build operations. Pay particular attention to added certificates, since their key holders can connect as the device.