CVE-2026-120997: Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role
Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerveshubweb allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member's role once when a page mounts, in the assignorgtoscope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects.
The dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user's id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session's LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user's current membership, until it expires.
This issue affects nerveshub: from 1.0.0 before 2.5.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nerves_hubto a version that resolves this vulnerability.Fixed in 2.5.3
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects nerves_hub versions from 1.0.0 before 2.5.3. The affected paths are dashboard pages, device console channels, local shell channels, and device event stream channels.
What access does an attacker need to exploit this?
An attacker must already be an organization member with an open dashboard page or joined channel established while they had a higher-privilege role. Alternatively, someone who obtains a console token from a page can open consoles as that user until the token expires, subject to that user's current membership.
When does the stale access end?
Open dashboard pages retain their previously loaded role until the page reloads. Open consoles and other affected sockets retain access until the socket disconnects; signing out disconnects only that session's LiveViews and does not revoke the 24-hour user-ID console token.
What can be done if upgrading is not immediately possible?
After removing or demoting a member, force affected dashboard pages to reload and disconnect their active console, local shell, and device event stream sockets. Treat console tokens exposed from pages as valid for up to 24 hours, because logout does not revoke them.