Missing Authorization Vulnerability in Nerves Hub Web Affects Device Management Functionality
CVE-2026-120286

5.3MEDIUM

Key Information:

Vendor

Nerves-hub

Status
Nerves Hub Web
Vendor
CVE Published:
10 November 2026

What is CVE-2026-120286?

A significant vulnerability in the Nerves Hub Web application allows authenticated users with a 'view' role to manipulate device settings and deployment groups. This misconfiguration permits unauthorized changes through LiveView events that should be restricted to users with a 'manage' role. Attackers exploiting this vulnerability can alter device certificates, change firmware release assignments, and manage deployment group configurations without necessary permissions. This poses a risk of unauthorized access and manipulation of device functionalities solely within the organization.

Affected Version(s)

nerves_hub_web 1.0.0 < 2.5.3

nerves_hub_web 1.0.0 < 2.5.3

nerves_hub_web 7b511764a468bb2c1f33945874faa86af2255c0c < 34ea112472a460319c1e1dec8ad0ffc37df05ffe

References

https://github.com/nerves-hub/nerves_hub_web/security/adv...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-120286.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-120286
related

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

arbor-s
arbor-s
Josh Kalderimis
Jonatan Männchen / EEF
.