https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 05:08:45 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-120295 <p>Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization&#39;s product via the &#34;Move device(s) to product&#34; action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product&#39;s organization at any role, and move-devices-product then changes each selected device&#39;s organization and product. The device API&#39;s move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter.</p> <p>A moved device keeps its key and certificate, joins the target organization&#39;s matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization.</p> <p>This issue affects nerves_hub: from 1.0.0 before 2.5.3.</p> <p>Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization&#39;s product via the &#34;Move device(s) to product&#34; action. The target-product event in NervesHubWeb.Live.Devices.Index looks the product up with NervesHub.Products.get_by_id/2, which checks that the user is a member of the product&#39;s organization at any role, and move-devices-product then changes each selected device&#39;s organization and product. The device API&#39;s move requires manage in the target organization, and an earlier fix added the check on the organization the devices leave but not on the one they enter.</p> <p>A moved device keeps its key and certificate, joins the target organization&#39;s matching deployment groups, and is sent their firmware with a download URL, which the view role cannot otherwise obtain. The user cannot change or control devices that already belong to the other organization.</p> <p>This issue affects nerves_hub: from 1.0.0 before 2.5.3.</p> https://db.gcve.eu/vuln/fkie_cve-2026-120295