# CVE-2026-120295: Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware

Status: published. Published: 2026-11-10. Updated: 2026-11-10.

Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via the "Move device(s) to product" action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product's organization at any role, and move-devices-product then changes each selected device's organization and product. The device API's move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter.

A moved device keeps its key and certificate, joins the target organization's matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization.

This issue affects nerves_hub: from 1.0.0 before 2.5.3.

## Remediation

- fix: Every move is recorded in the target product's audit log as "User  moved device  to  : ". After upgrading, review the audit_logs rows with resource type NervesHub.Products.Product and a description containing "moved device" whose actor does not hold the manage or admin role in that organization, and move or remove the devices they brought in. Roles may have changed since a move, and entries older than the retention period are gone when TRUNCATE_AUDIT_LOGS_ENABLED is on. (source: CNA: EEF)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/nerves-hub/nerves_hub_web/commit/1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa

## Affected products and versions

- nerves-hub / nerves_hub_web (nerves-hub/nerves-hub): ≥ 1.0.0; < 2.5.3 (affected, other). Source: CNA: EEF
- nerves-hub / nerves_hub_web (nerves_hub): ≥ 1.0.0; < 2.5.3 (affected, semver). Source: CNA: EEF
- nerves-hub / nerves_hub_web (nerves-hub/nerves_hub_web): ≥ adaeefdb7a835525482588f43332ef988cc448c7; < * (affected, git); ≥ 79743ef08f7f801617b653fd09f37c01ed9b4be0; < 1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa (affected, git). Source: CNA: EEF

## Severity and prioritization

- CVSS 4.0: 7.1 (high); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N; source: CNA: EEF

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-863

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-2j7r-q3vm-8j34 (CNA: EEF; vendor-advisory, related)

- https://cna.erlef.org/cves/CVE-2026-120295.html (CNA: EEF; related)

- https://osv.dev/vulnerability/EEF-CVE-2026-120295 (CNA: EEF; related)

- https://github.com/nerves-hub/nerves_hub_web/commit/adaeefdb7a835525482588f43332ef988cc448c7 (CNA: EEF; related)

- https://github.com/nerves-hub/nerves_hub_web/commit/79743ef08f7f801617b653fd09f37c01ed9b4be0 (CNA: EEF; related)

- https://github.com/nerves-hub/nerves_hub_web/commit/1bc8be875ab6b1eb904e5ff60c8a1421c5c700fa (CNA: EEF; patch)

## Provenance

- CNA: EEF: https://www.cve.org/CVERecord?id=CVE-2026-120295; retrieved 2026-11-10; source updated 2026-11-10

Revision: 30744bef2b3aed8703541ea3d7a6c1e9d21f2adbaa3e1ab93056cbb0aa127d47

Canonical: https://y2.dev/cve/CVE-2026-120295

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.