CVE-2026-120286: Auth Bypass

Description

Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member. A view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to. This issue affects nerves_hub: from 1.0.0 before 2.5.3.

Is your site exposed to CVE-2026-120286?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-862 Missing Authorization

References

Other References

https://cna.erlef.org/cves/CVE-2026-120286.html https://github.com/nerves-hub/nerves_hub_web/commit/34ea112472a460319c1e1dec8ad0ffc37df05ffe https://github.com/nerves-hub/nerves_hub_web/commit/7b511764a468bb2c1f33945874faa86af2255c0c https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-gxj7-m8x6-r644 https://osv.dev/vulnerability/EEF-CVE-2026-120286

Frequently Asked Questions

What is CVE-2026-120286? +

Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member. A view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to. This issue affects nerves_hub: from 1.0.0 before 2.5.3.

How do I check if I'm vulnerable to CVE-2026-120286? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-40570

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action in `POST /conversation/ajax` …

CVE-2026-68533

Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" …

CVE-2026-113374

Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user …

CVE-2026-113368

Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository …

CVE-2026-42317

GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and …

CVE-2026-81908

Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method …

CVE-2026-120286