The vulnerability CVE-2026-28806 in nerves_hub_web arises from missing authorization checks in device bulk actions and device update API endpoints. Authenticated users can manipulate device identifiers to target and control devices belonging to other organizations, performing management actions beyond their privileges. This improper authorization (CWE-285) and potential for unauthorized access to device functionality (CWE-668) can disrupt device operations and, with additional features like remote console access, may lead to full device compromise. The issue affects nerves_hub_web versions from 1.0.0 up to but not including 2.4.0.

Exploitation allows attackers with authenticated access to control devices outside their organization, potentially interfering with firmware updates, accessing device features, and disrupting device connectivity. In setups with remote console access enabled, attackers could fully compromise affected devices. This poses a significant risk to device integrity and availability across organizations using vulnerable versions of nerves_hub_web.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to trusted personnel only and monitor for unusual device management activities. Avoid enabling additional features such as remote console access unless necessary and ensure strict access controls are in place. Follow vendor communications closely for updates on patches or official mitigations.