{"affected":[{"ranges":[{"events":[{"introduced":"7b511764a468bb2c1f33945874faa86af2255c0c"},{"fixed":"34ea112472a460319c1e1dec8ad0ffc37df05ffe"}],"repo":"https://github.com/nerves-hub/nerves_hub_web","type":"GIT"}]}],"aliases":["GHSA-gxj7-m8x6-r644","CVE-2026-120286"],"credits":[{"name":"arbor-s","type":"FINDER"},{"name":"arbor-s","type":"REPORTER"},{"name":"Josh Kalderimis","type":"REMEDIATION_DEVELOPER"},{"name":"Jonatan Männchen / EEF","type":"COORDINATOR"}],"database_specific":{"capec_ids":["CAPEC-1"],"cpe_ids":["cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*"],"cwe_ids":["CWE-862"]},"details":"## Summary\n\nMissing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the `view` role to change devices and deployment groups via LiveView events reserved for the `manage` role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling `authorized!/2`, and the pages render the controls to every member.\n\nA `view` member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to.\n\nThis issue affects nerves_hub: from 1.0.0 before 2.5.3.\n\n## Details\n\nThe dashboard reads the member's role into `current_scope` when a page mounts, and each privileged event handler is expected to call `authorized!/2` with the permission it needs, all of which resolve to the `manage` role in `lib/nerves_hub_web/helpers/authorization.ex`. These handlers never do:\n\n**Device settings tab** (`NervesHubWeb.Components.DevicePage.SettingsTab`): `hooked_event/3` for `delete-certificate`, and `handle_progress/3` for the `certificate` upload, which should require `device:update`.\n\n**Device details tab** (`NervesHubWeb.Components.DevicePage.DetailsTab`): `hooked_event/3` for `add-tag`, `remove-tag`, `save-location-changes` and `clear-manual-location-information` (`device:update`), and `remove-from-deployment-group` (`device:set-deployment-group`).\n\n**Deployment group page** (`NervesHubWeb.Live.DeploymentGroups.Show` and `NervesHubWeb.Components.DeploymentGroupPage.Summary`): `handle_event/3` for `move-matched-devices-to-deployment-group` and `remove-unmatched-devices-from-deployment-group`, and `handle_progress/3` for the `device_csv` upload (`device:set-deployment-group`), plus `generate-firmware-deltas`, `retry_delta` and `delete_delta` (`deployment_group:update`).\n\nThe pages show every one of these controls to `view` members, so each change takes a click, and a client can send the events directly over the LiveView socket regardless.\n\n## Proof of concept\n\n1. Create deployment group `canary` with conditions matching tag `beta`.\n2. Create `device_outside_match` in the same product with tag `beta` and no deployment group, and `device_inside_mismatch` in deployment group `canary` with tag `foo`.\n3. Sign in as a member of the organization with the `view` role and open `/org/<org>/<product>/deployment_groups/canary`.\n4. Click `Move device(s)`: `device_outside_match` is now in `canary`. Click `Remove device(s)`: `device_inside_mismatch` no longer has a deployment group.\n5. As the same member, open a device in the product and add a tag. The tag is saved.\n6. On the device's settings tab, delete a certificate, or upload a self-signed one. The change is saved, and a client presenting the uploaded certificate connects as the device.\n\n## Impact\n\nAn organization member with the view role can add or delete a device's certificates, change its tags and location, and move devices into or out of deployment groups, which changes the firmware release they receive. An added certificate lets whoever holds its key connect as the device and persists after the member leaves. Everything stays within the organizations the member belongs to.\n\n## Workarounds\n\nNo configuration closes the hole. Until the upgrade, give the `view` role only to people you would trust with the `manage` role on that organization's devices.\n\n## Solutions\n\nUpgrading does not remove a certificate that a `view` member already added. After upgrading, review each device's certificates and delete any you do not recognize.","id":"EEF-CVE-2026-120286","modified":"2026-11-10T10:44:08.751429Z","published":"2026-11-10T10:44:07.907Z","references":[{"type":"ADVISORY","url":"https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-gxj7-m8x6-r644"},{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-120286.html"},{"type":"WEB","url":"https://github.com/nerves-hub/nerves_hub_web/commit/7b511764a468bb2c1f33945874faa86af2255c0c"},{"type":"FIX","url":"https://github.com/nerves-hub/nerves_hub_web/commit/34ea112472a460319c1e1dec8ad0ffc37df05ffe"}],"related":[],"schema_version":"1.7.3","severity":[{"score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:N","type":"CVSS_V4"}],"summary":"Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups","upstream":[]}