CVE-2026-48592
Description
Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution. The handle_event("save-job", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller's privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job's worker field with any other existing Oban.Worker module in the application. On the job's next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one. This issue affects oban_web: from 2.12.0 before 2.12.5.
How to fix
- oban_web_project oban_web2.12.5, ab3c5d1d3eba06c62045f16f2cd7781c7752e248 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oban_web_project oban_web | 2.12.0 ≤ v < 2.12.5, a17bc8c31286c9d516e2892cf5483d1c95e65d6c ≤ v < ab3c5d1d3eba06c62045f16f2cd7781c7752e248 | 2.12.5, ab3c5d1d3eba06c62045f16f2cd7781c7752e248 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.