Incorrect Authorization in NervesHub Web Affecting Device Management

CVE-2026-120295

What is CVE-2026-120295?

An Incorrect Authorization flaw exists in the device management feature of NervesHub Web. Authenticated users with the 'manage' role in one organization can leverage this vulnerability to move devices to another organization's product, despite only holding the 'view' role in that organization. While moving the devices, an attacker could inadvertently allow access to firmware and other sensitive resources that should remain restricted. This situation arises because the system only verifies user permissions for the organization the device is leaving, not for the organization to which it is being moved. The devices retain their keys and certificates, making them capable of joining deployment groups and receiving firmware updates, which is typically inaccessible to those with limited roles. Organizations using NervesHub Web from versions 1.0.0 to below 2.5.3 should assess their security configurations and apply necessary updates to mitigate this risk.

References