Answer in brief
CVE-2026-120295 records a High severity (CVSS 7.1) vulnerability in Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware. The current sources do not mark it as known exploited. The current feed maps nerves-hub/nerves-hub/nerves-hub (generic), nerves-hub/nerves-hub/nerves_hub_web (generic), nerves-hub/nerves_hub_web (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps nerves-hub/nerves-hub/nerves-hub (generic), nerves-hub/nerves-hub/nerves_hub_web (generic), nerves-hub/nerves_hub_web (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| nerves-hub/nerves-hub/nerves-hubgeneric | >=1.0.0 <2.5.3 | 2.5.3 |
| nerves-hub/nerves-hub/nerves_hub_webgeneric | >=adaeefdb7a835525482588f43332ef988cc448c7 <* || >=79743ef08f7f801617b653fd09f37c01ed9b4be0 <1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa | *, 1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa |
| nerves-hub/nerves_hub_webgeneric | >=1.0.0 <2.5.3 | 2.5.3 |
Published upstream
Nov 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 10, 2026
Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via the "Move device(s) to product" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product's organization at any role, and move-devices-product then changes each selected device's organization and product. The device API's move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter. A moved device keeps its key and certificate, joins the target organization's matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization. This issue affects nerves_hub: from 1.0.0 before 2.5.3.
Quoted source text, attributed separately from HOL analysis.