CVE-2026-28806 is a critical Improper Authorization vulnerability affecting nerves-hub nerves_hub_web versions 1.0.0 through 2.3.x. It allows authenticated users to bypass authorization checks in device bulk actions and update APIs, enabling them to manage devices belonging to other organizations. With a CVSS score of 9.4 (Critical), this vulnerability can be exploited remotely by a low-privileged authenticated user without user interaction, potentially leading to firmware interference, service disruption, or full device compromise. Currently, there is no evidence of active exploitation, public exploit code, or significant community attention, and its EPSS score indicates a very low likelihood of exploitation in the wild.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.0.0, < 2.4.0CPE matchmatch criteria | cpe:2.3:a:nerves-hub:nerveshub:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.