https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 04:50:05 +0000 https://db.gcve.eu/vuln/cve-2026-120730 <p><strong>Affected:</strong> nerves-hub nerves_hub_web</p> <p>Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session&#39;s organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user&#39;s own organization, and any account can create one.</p> <p>A device placed on another organization&#39;s deployment group, or moved into its product, is sent that organization&#39;s firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.</p> <p>This issue affects nerves_hub: from 1.0.0 before 2.5.3.</p> <p><strong>Affected:</strong> nerves-hub nerves_hub_web</p> <p>Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session&#39;s organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user&#39;s own organization, and any account can create one.</p> <p>A device placed on another organization&#39;s deployment group, or moved into its product, is sent that organization&#39;s firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.</p> <p>This issue affects nerves_hub: from 1.0.0 before 2.5.3.</p> https://db.gcve.eu/vuln/cve-2026-120730