CVE-2026-120295

An Incorrect Authorization vulnerability in nerves_hub nerves_hub_web (versions 1.0.0 before 2.5.3) allows an authenticated user with a manage role in one organization and only a view role in another to move their own devices into a product belonging to the second organization. The flaw exists be...