Improper Modification Control in NervesHub Device API by Nerves Hub

CVE-2026-120730

What is CVE-2026-120730?

The Nerves Hub's device API has a vulnerability that permits an authenticated user managing devices in one organization to inadvertently modify components, such as devices, signing keys, and products, in other organizations. This is facilitated through the submission of organization-specific IDs within fields like org_id, product_id, and deployment_id. Even though users cannot alter existing devices linked to other organizations or upload firmware, they can access another organization's firmware due to inadequate control of the request parameters. The issue is present in versions of nerves_hub before 2.5.3.

References