# CVE-2026-120730: Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware

Status: published. Published: 2026-11-10. Updated: 2026-11-10.

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one.

A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.

This issue affects nerves_hub: from 1.0.0 before 2.5.3.

## Remediation

- fix: The fixed release's migration takes every device off a deployment group that belongs to a different product and logs each one. Upgrading undoes nothing else done this way. After upgrading, check the database for devices whose organization does not own their product, for signing keys in org_keys whose created_by_id has never been a member of the key's organization, and for certificate authorities whose JITP product belongs to another organization, and remove what you do not recognize. A device moved wholly into another organization, and a product added to one, leave nothing that sets them apart, so review your organization's devices and products as well. (source: CNA: EEF)
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: EEF) — https://github.com/nerves-hub/nerves_hub_web/commit/c367d7d17d07f843e78a70d15904665616dde964

## Affected products and versions

- nerves-hub / nerves_hub_web (nerves-hub/nerves-hub): ≥ 1.0.0; < 2.5.3 (affected, other). Source: CNA: EEF
- nerves-hub / nerves_hub_web (nerves_hub): ≥ 1.0.0; < 2.5.3 (affected, semver). Source: CNA: EEF
- nerves-hub / nerves_hub_web (nerves-hub/nerves_hub_web): ≥ f58d58233dbd355c58d3a140107ece18e8863f14; < c367d7d17d07f843e78a70d15904665616dde964 (affected, git). Source: CNA: EEF

## Severity and prioritization

- CVSS 4.0: 8.6 (high); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N; source: CNA: EEF

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-639, CWE-915

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-rpp7-x9hm-jrmr (CNA: EEF; vendor-advisory, related)

- https://cna.erlef.org/cves/CVE-2026-120730.html (CNA: EEF; related)

- https://osv.dev/vulnerability/EEF-CVE-2026-120730 (CNA: EEF; related)

- https://github.com/nerves-hub/nerves_hub_web/commit/f58d58233dbd355c58d3a140107ece18e8863f14 (CNA: EEF; related)

- https://github.com/nerves-hub/nerves_hub_web/commit/c367d7d17d07f843e78a70d15904665616dde964 (CNA: EEF; patch)

## Provenance

- CNA: EEF: https://www.cve.org/CVERecord?id=CVE-2026-120730; retrieved 2026-11-10; source updated 2026-11-10

Revision: facc74d16b99b7f5acb88175ff0338579a07185f8ff4c2c19494574c423ac233

Canonical: https://y2.dev/cve/CVE-2026-120730

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.