CVE-2026-120295: Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware
Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerveshubweb allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via the "Move device(s) to product" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.getbyid/2, which checks that the user is a member of the product's organization at any role, and move-devices-product then changes each selected device's organization and product. The device API's move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter.
A moved device keeps its key and certificate, joins the target organization's matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization.
This issue affects nerveshub: from 1.0.0 before 2.5.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nerves_hubto a version that resolves this vulnerability.Fixed in 2.5.3 - Operational
After upgrading, review audit_logs rows with resource type NervesHub.Products.Product and a description containing "moved device" where the actor does not hold the manage or admin role in the target organization, then move or remove the devices they brought in.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user needs the manage role in the organization that currently owns the devices and only the view role in a different organization containing the target product. They cannot use this issue to alter or control devices that already belong to the other organization.
What is the impact of moving a device into the target organization?
The moved device retains its key and certificate, joins matching deployment groups in the target organization, and receives their firmware and a download URL. This can give a view-role user access to firmware that role would not otherwise be able to obtain.
Which versions are affected?
The issue affects nerves_hub versions from 1.0.0 before 2.5.3.