Improper Authorization in Nerves Hub Web Affects Device Control
CVE-2026-28806

9.4CRITICAL

Key Information:

Vendor

Nerves-hub

Status
Nerves Hub Web
Vendor
CVE Published:
10 March 2026

What is CVE-2026-28806?

The Nerves Hub Web platform has a vulnerability that permits authenticated users to manipulate devices across organizational boundaries. This flaw arises from missing authorization checks in the device bulk actions and update API endpoints. As a result, attackers can select and manage devices that do not belong to their organization by tampering with device identifiers. This can lead to unauthorized firmware update manipulations, unauthorized access to device functionalities, and potential disruptions in device connectivity. In environments with additional functionalities like remote console access enabled, the repercussions could extend to complete device compromise.

Affected Version(s)

nerves_hub_web 1.0.0 < 2.4.0

nerves_hub_web 1.0.0 < 2.4.0

nerves_hub_web adaeefdb7a835525482588f43332ef988cc448c7 < 1f69c9d595684a4650c3ac702f3dc7c5bcd7526c

References

https://github.com/nerves-hub/nerves_hub_web/security/adv...
vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-28806.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-28806
related

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Josh Kalderimis / NervesHub team & NervesCloud
Jonatan Männchen / EEF
Lars Wikman / NervesHub team & NervesCloud
.