# CVE-2026-120730: NervesHub cross-organization data access via object attribute injection

Source: https://junglewise.ai/threats/cve-2026-120730-improperly-controlled-modification-of-dynamically-determined  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-120730 · Severity: info · Published 2026-11-10

NervesHub is a firmware deployment platform for IoT devices. An authenticated user with device management privileges can manipulate API parameters to access and send firmware to devices belonging to other organizations. While an attacker cannot directly control or modify devices in other organizations, they can cause those devices to receive firmware packages from unintended sources.

Technologies: [NervesHub Nerves Hub Web](https://junglewise.ai/threats/technologies/nerves-hub-web). Vendors: [NervesHub](https://junglewise.ai/threats/vendors/nerveshub).

## Quick answers

**Is CVE-2026-120730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120730 being exploited in the wild.

**How severe is CVE-2026-120730?** Informational severity, published 10 November 2026.

**Which products and versions are affected?** NervesHub Nerves Hub Web 1.0.0 before 2.5.3.

**Is there a fix for CVE-2026-120730?** Yes: fixed in nerves_hub_web 2.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120730 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-120730?** Check whether you run NervesHub Nerves Hub Web at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in nerves_hub_web 2.5.3

## Technical details

The device API and dashboard forms fail to properly validate organization ownership when processing org_id, product_id, and deployment_id parameters. An authenticated user with the manage role in their own organization can submit crafted parameters to the device create/update endpoints, device forms, signing key forms, product forms, and JITP settings to associate devices with other organizations' deployment groups or products. The attacker gains the ability to direct cross-organization firmware distribution but cannot modify or control devices already owned by target organizations.

## Affected products

- NervesHub nerves_hub_web 1.0.0 before 2.5.3

## Timeline

- 2026-11-10: disclosed

## References

- [https://ghcr.io/](https://ghcr.io/)
- [https://github.com/](https://github.com/)

## Related threats

- [NervesHub improper authentication in sign-in and email confirmation](https://junglewise.ai/threats/cve-2026-120999-improper-authentication-vulnerability-in-google-sign-in-and)
- [NervesHub nerves_hub_web incorrect authorization in bulk move](https://junglewise.ai/threats/cve-2026-120295-incorrect-authorization-vulnerability-in-the-devices-page-bulk)
- [nerves_hub_web session fixation in CLI login](https://junglewise.ai/threats/cve-2026-119446-session-fixation-vulnerability-in-the-cli-login-flow-in-nerves)