CVE-2026-120730: Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerveshubweb allows an authenticated user who manages devices in any organization to write into other organizations via submitted orgid, productid and deploymentid fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted orgid wins, and the JITP changeset accepts any productid. Each request requires the manage role only in the user's own organization, and any account can create one.
A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.
This issue affects nerveshub: from 1.0.0 before 2.5.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nerves_hubto a version that resolves this vulnerability.Fixed in 2.5.3 - Operational
After upgrading, review the organization's devices and products, then check for devices whose organization does not own their product, signing keys in org_keys whose created_by_id has never been a member of the key's organization, and certificate authorities whose JITP product belongs to another organization; remove anything unrecognized.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated account that has the manage role for devices in at least one organization can exploit it. Because any account can create an organization, an attacker does not need pre-existing access to the target organization.
What does an attacker need to submit to cross organization boundaries?
The attacker must submit organization, product, or deployment group identifiers belonging to another organization through the affected API endpoints or forms. The affected paths include device creation and updates, dashboard device forms, signing key and product forms, and JITP settings.
What is the practical impact on a target organization?
An attacker can place a device into another organization's deployment group or product and receive that organization's firmware and its download URL. They cannot take control of devices already owned by that organization or upload firmware into it.
Which versions are affected?
nerves_hub versions from 1.0.0 up to, but not including, 2.5.3 are affected.