CVE-2026-120730 | nerves-hub nerves_hub_web up to 2.5.2 Device API NervesHub.Devices.Device.changeset org_id/product_id/deployment_id dynamically-determined object attributes

A vulnerability identified as problematic has been detected in nerves-hub nerves_hub_web up to 2.5.2. This affects the function NervesHub.Devices.Device.changeset of the component Device API. Performing a manipulation of the argument org_id/product_id/deployment_id results in dynamically-determined object attributes.

This vulnerability is reported as CVE-2026-120730. The attack is possible to be carried out remotely. No exploit exists.

You should upgrade the affected component.VulDB Recent EntriesRead More