CVE Watch10 de nov. de 2026

CVE-2026-120286

Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organizati

CVSS

—

Sem CVSS

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-862

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and delete device certificates, add and remove tags, overwrite or clear a device's manual location, remove a device from its deployment group, move matched devices into a deployment group or remove unmatched ones, import devices from a CSV, and start, retry or delete firmware delta builds carry out the change without calling authorized!/2, and the pages render the controls to every member. A view member can add a certificate that lets whoever holds its key connect as the device, delete a certificate so the device can no longer authenticate with it, and change which deployment group, and so which firmware release, a device receives. Everything stays within the organizations the member belongs to. This issue affects nerves_hub: from 1.0.0 before 2.5.3.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1253378.3 ALT

—

——0Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dispatches onImport(), onImportLoadForm(), onImportLoadColumnSampleForm(), onExport(), and onExportLoadForm() before those gated actions run, and the separately reachable download() action also lacks the granular export check. An authenticated backend user with a valid session and coarse access through $requiredPermissions, but without the configured import[permissions] or export[permissions], can use the import handlers to write or overwrite records and can use onExport() followed by download() to retrieve the complete dataset exposed by the export model. Controllers without granular permission keys are unaffected because userHasAccess() is intentionally default-permissive. This issue is fixed in version 1.2.14.5h CVE-2026-1208054.3 MÉD

—

——0In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-related parameters to redirect internal Queryable Encryption metadata writes to metadata belonging to other encrypted collections within the same database. The server’s authorization layer validated only the user-facing target collection namespace, while subsequent internal writes derived from client-supplied parameters were performed with elevated internal privileges, bypassing the original caller’s permission scope. This could allow unauthorized writes into another collection’s Queryable Encryption metadata, potentially corrupting encrypted index state and compaction operations.5h CVE-2026-968457.8 ALT

—

——0Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.6h CVE-2026-961335.5 MÉD

—

——0Improper access control in Windows Graphics Kernel allows an authorized attacker to disclose information locally.6h CVE-2026-960297.8 ALT

—

——0Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally.6h CVE-2026-881768.8 ALT

—

——0Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.6h