A critical improper authorization vulnerability in Nerves-Hub nerves_hub_web allows unauthorized users to manipulate devices across different organizations.

The software fails to implement adequate authorization checks, specifically in the device bulk actions and device update API components. This allows an authenticated user to perform unauthorized operations on resources outside their assigned scope.

This vulnerability poses a severe risk to multi-tenant environments, as it allows for unauthorized cross-organization control. Successful exploitation could lead to full device takeover, configuration tampering, or service disruption, directly impacting the integrity and availability of managed device fleets.

Immediate Action: Update the nerves_hub_web package to version 2.4.0 or later to ensure proper authorization controls are enforced.

Proactive Monitoring: Audit logs for suspicious API calls related to device bulk actions or updates, particularly those originating from unexpected user accounts.

Compensating Controls: Restrict API access to trusted IP ranges and ensure that administrative sessions are strictly monitored and limited to necessary personnel.

Public Exploit Available: Unknown

The ability to perform cross-organization device control is a critical security failure in a management platform. Organizations using nerves_hub_web must prioritize updating to version 2.4.0 immediately to prevent unauthorized access and maintain the security of their device infrastructure.