Vulnerability-Lookup

CVE-2026-48592 (GCVE-0-2026-48592)

Vulnerability from cvelistv5 – Published: 2026-05-26 19:46 – Updated: 2026-05-27 15:41

Title

Missing authorization check on save-job event handler in oban_web

Summary

Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution. The handle_event("save-job", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller's privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job's worker field with any other existing Oban.Worker module in the application. On the job's next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one. This issue affects oban_web: from 2.12.0 before 2.12.5.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-26 20:46 UTC

CWE

CWE-862 - Missing Authorization

Assigner

EEF CNA under the mitre root

CNA scorecard A 97/100 over 357 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/oban-bg/oban_web/security/advi…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-48592.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-48592	related
https://github.com/oban-bg/oban_web/commit/ab3c5d…	patch

Impacted products

2 products

Vendor	Product	Version	CPE status
oban-bg	oban_web	Affected: 2.12.0 , < 2.12.5 (semver) cpe:2.3:a:oban_web_project:oban_web::::::::
oban-bg	oban_web	Affected: a17bc8c31286c9d516e2892cf5483d1c95e65d6c , < ab3c5d1d3eba06c62045f16f2cd7781c7752e248 (git) cpe:2.3:a:oban_web_project:oban_web::::::::

Credits

Peter Ullrich Parker Selbert Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48592",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-26T20:46:44.585227Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-26T20:46:50.037Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027"
          ],
          "packageName": "oban_web",
          "packageURL": "pkg:hex/oban_web",
          "product": "oban_web",
          "programFiles": [
            "lib/oban/web/live/jobs/detail_component.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027:handle_event/3"
            }
          ],
          "vendor": "oban-bg",
          "versions": [
            {
              "lessThan": "2.12.5",
              "status": "affected",
              "version": "2.12.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027"
          ],
          "packageName": "oban-bg/oban_web",
          "packageURL": "pkg:github/oban-bg/oban_web",
          "product": "oban_web",
          "programFiles": [
            "lib/oban/web/live/jobs/detail_component.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027:handle_event/3"
            }
          ],
          "repo": "https://github.com/oban-bg/oban_web.git",
          "vendor": "oban-bg",
          "versions": [
            {
              "lessThan": "ab3c5d1d3eba06c62045f16f2cd7781c7752e248",
              "status": "affected",
              "version": "a17bc8c31286c9d516e2892cf5483d1c95e65d6c",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe Oban.Web dashboard must be deployed and accessible to users with less than full job-management privileges (e.g. \u003ctt\u003e:read_only\u003c/tt\u003e).\u003c/p\u003e"
            }
          ],
          "value": "The Oban.Web dashboard must be deployed and accessible to users with less than full job-management privileges (e.g. :read_only)."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.12.5",
                  "versionStartIncluding": "2.12.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Parker Selbert"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing Authorization vulnerability in oban-bg oban_web (\u003ctt\u003e\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027\u003c/tt\u003e modules) allows unauthorized job worker substitution.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003ehandle_event(\"save-job\", ...)\u003c/tt\u003e handler in \u003ctt\u003e\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027\u003c/tt\u003e does not perform an authorization check, unlike the sibling \u003ctt\u003ecancel\u003c/tt\u003e, \u003ctt\u003edelete\u003c/tt\u003e, and \u003ctt\u003eretry\u003c/tt\u003e handlers which all verify the caller\u0027s privileges via \u003ctt\u003ecan?/2\u003c/tt\u003e. An authenticated user with \u003ctt\u003e:read_only\u003c/tt\u003e access can push a forged \u003ctt\u003esave-job\u003c/tt\u003e LiveView WebSocket event to overwrite a job\u0027s \u003ctt\u003eworker\u003c/tt\u003e field with any other existing \u003ctt\u003eOban.Worker\u003c/tt\u003e module in the application. On the job\u0027s next execution attempt, Oban will invoke \u003ctt\u003eperform/1\u003c/tt\u003e on the attacker-chosen module instead of the intended one.\u003c/p\u003e\u003cp\u003eThis issue affects oban_web: from 2.12.0 before 2.12.5.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in oban-bg oban_web (\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027 modules) allows unauthorized job worker substitution.\n\nThe handle_event(\"save-job\", ...) handler in \u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027 does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller\u0027s privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job\u0027s worker field with any other existing Oban.Worker module in the application. On the job\u0027s next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.\n\nThis issue affects oban_web: from 2.12.0 before 2.12.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T15:41:23.434Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-48592.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48592"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Missing authorization check on save-job event handler in oban_web",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-48592",
    "datePublished": "2026-05-26T19:46:48.611Z",
    "dateReserved": "2026-05-22T09:36:56.834Z",
    "dateUpdated": "2026-05-27T15:41:23.434Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-48592",
      "date": "2026-11-15",
      "epss": "0.005",
      "percentile": "0.43442"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.hex.pm",
                "cpes": [
                  "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027"
                ],
                "packageName": "oban_web",
                "packageURL": "pkg:hex/oban_web",
                "product": "oban_web",
                "programFiles": [
                  "lib/oban/web/live/jobs/detail_component.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027:handle_event/3"
                  }
                ],
                "vendor": "oban-bg",
                "versions": [
                  {
                    "lessThan": "2.12.5",
                    "status": "affected",
                    "version": "2.12.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "collectionURL": "https://github.com",
                "cpes": [
                  "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unaffected",
                "modules": [
                  "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027"
                ],
                "packageName": "oban-bg/oban_web",
                "packageURL": "pkg:github/oban-bg/oban_web",
                "product": "oban_web",
                "programFiles": [
                  "lib/oban/web/live/jobs/detail_component.ex"
                ],
                "programRoutines": [
                  {
                    "name": "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027:handle_event/3"
                  }
                ],
                "repo": "https://github.com/oban-bg/oban_web.git",
                "vendor": "oban-bg",
                "versions": [
                  {
                    "lessThan": "ab3c5d1d3eba06c62045f16f2cd7781c7752e248",
                    "status": "affected",
                    "version": "a17bc8c31286c9d516e2892cf5483d1c95e65d6c",
                    "versionType": "git"
                  }
                ]
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Missing Authorization vulnerability in oban-bg oban_web (\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027 modules) allows unauthorized job worker substitution.\n\nThe handle_event(\"save-job\", ...) handler in \u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027 does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller\u0027s privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job\u0027s worker field with any other existing Oban.Worker module in the application. On the job\u0027s next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.\n\nThis issue affects oban_web: from 2.12.0 before 2.12.5."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad de autorizaci\u00f3n faltante en oban-bg oban_web (m\u00f3dulos \u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027) permite la sustituci\u00f3n no autorizada del trabajador de tareas.\n\nEl gestor handle_event(\"save-job\", ...) en \u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027 no realiza una verificaci\u00f3n de autorizaci\u00f3n, a diferencia de los gestores hermanos de cancelaci\u00f3n, eliminaci\u00f3n y reintento, los cuales todos verifican los privilegios del llamador a trav\u00e9s de can?/2. Un usuario autenticado con acceso de :solo_lectura puede enviar un evento WebSocket forjado de LiveView de save-job para sobrescribir el campo de trabajador de una tarea con cualquier otro m\u00f3dulo Oban.Worker existente en la aplicaci\u00f3n. En el siguiente intento de ejecuci\u00f3n de la tarea, Oban invocar\u00e1 perform/1 en el m\u00f3dulo elegido por el atacante en lugar del previsto.\n\nEste problema afecta a oban_web: desde 2.12.0 antes de 2.12.5."
          }
        ],
        "id": "CVE-2026-48592",
        "lastModified": "2026-07-24T11:10:00.170",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "LOW",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-48592",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-26T20:46:44.585227Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-26T21:16:41.707",
        "references": [
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://cna.erlef.org/cves/CVE-2026-48592.html"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33"
          },
          {
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48592"
          }
        ],
        "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-862"
              }
            ],
            "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-05-27T20:13:54+00:00",
      "cve": "CVE-2026-48592",
      "id": "CVE-2026-48592",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Missing authorization check on save-job event handler in oban_web",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48592.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-48592",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-26T20:46:44.585227Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-26T20:46:47.428Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://repo.hex.pm",
              "cpes": [
                "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027"
              ],
              "packageName": "oban_web",
              "packageURL": "pkg:hex/oban_web",
              "product": "oban_web",
              "programFiles": [
                "lib/oban/web/live/jobs/detail_component.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027:handle_event/3"
                }
              ],
              "vendor": "oban-bg",
              "versions": [
                {
                  "lessThan": "2.12.5",
                  "status": "affected",
                  "version": "2.12.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "collectionURL": "https://github.com",
              "cpes": [
                "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"
              ],
              "defaultStatus": "unaffected",
              "modules": [
                "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027"
              ],
              "packageName": "oban-bg/oban_web",
              "packageURL": "pkg:github/oban-bg/oban_web",
              "product": "oban_web",
              "programFiles": [
                "lib/oban/web/live/jobs/detail_component.ex"
              ],
              "programRoutines": [
                {
                  "name": "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027:handle_event/3"
                }
              ],
              "repo": "https://github.com/oban-bg/oban_web.git",
              "vendor": "oban-bg",
              "versions": [
                {
                  "lessThan": "ab3c5d1d3eba06c62045f16f2cd7781c7752e248",
                  "status": "affected",
                  "version": "a17bc8c31286c9d516e2892cf5483d1c95e65d6c",
                  "versionType": "git"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThe Oban.Web dashboard must be deployed and accessible to users with less than full job-management privileges (e.g. \u003ctt\u003e:read_only\u003c/tt\u003e).\u003c/p\u003e"
                }
              ],
              "value": "The Oban.Web dashboard must be deployed and accessible to users with less than full job-management privileges (e.g. :read_only)."
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "2.12.5",
                      "versionStartIncluding": "2.12.0",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ],
              "operator": "AND"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Peter Ullrich"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Parker Selbert"
            },
            {
              "lang": "en",
              "type": "analyst",
              "value": "Jonatan M\u00e4nnchen / EEF"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eMissing Authorization vulnerability in oban-bg oban_web (\u003ctt\u003e\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027\u003c/tt\u003e modules) allows unauthorized job worker substitution.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003ehandle_event(\"save-job\", ...)\u003c/tt\u003e handler in \u003ctt\u003e\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027\u003c/tt\u003e does not perform an authorization check, unlike the sibling \u003ctt\u003ecancel\u003c/tt\u003e, \u003ctt\u003edelete\u003c/tt\u003e, and \u003ctt\u003eretry\u003c/tt\u003e handlers which all verify the caller\u0027s privileges via \u003ctt\u003ecan?/2\u003c/tt\u003e. An authenticated user with \u003ctt\u003e:read_only\u003c/tt\u003e access can push a forged \u003ctt\u003esave-job\u003c/tt\u003e LiveView WebSocket event to overwrite a job\u0027s \u003ctt\u003eworker\u003c/tt\u003e field with any other existing \u003ctt\u003eOban.Worker\u003c/tt\u003e module in the application. On the job\u0027s next execution attempt, Oban will invoke \u003ctt\u003eperform/1\u003c/tt\u003e on the attacker-chosen module instead of the intended one.\u003c/p\u003e\u003cp\u003eThis issue affects oban_web: from 2.12.0 before 2.12.5.\u003c/p\u003e"
                }
              ],
              "value": "Missing Authorization vulnerability in oban-bg oban_web (\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027 modules) allows unauthorized job worker substitution.\n\nThe handle_event(\"save-job\", ...) handler in \u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027 does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller\u0027s privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job\u0027s worker field with any other existing Oban.Worker module in the application. On the job\u0027s next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.\n\nThis issue affects oban_web: from 2.12.0 before 2.12.5."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-1",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "LOW",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "LOW"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862 Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-27T15:41:23.434Z",
            "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
            "shortName": "EEF"
          },
          "references": [
            {
              "tags": [
                "vendor-advisory",
                "related"
              ],
              "url": "https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://cna.erlef.org/cves/CVE-2026-48592.html"
            },
            {
              "tags": [
                "related"
              ],
              "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48592"
            },
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248"
            }
          ],
          "source": {
            "discovery": "EXTERNAL"
          },
          "title": "Missing authorization check on save-job event handler in oban_web",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "assignerShortName": "EEF",
        "cveId": "CVE-2026-48592",
        "datePublished": "2026-05-26T19:46:48.611Z",
        "dateReserved": "2026-05-22T09:36:56.834Z",
        "dateUpdated": "2026-05-27T15:41:23.434Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-48592

Vulnerability from fkie_nvd - Published: 2026-05-26 21:16 - Updated: 2026-07-24 11:10

Severity

5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://cna.erlef.org/cves/CVE-2026-48592.html
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33
	6b3ad84c-e1a6-4bf7-a703-f496b71e49db	https://osv.dev/vulnerability/EEF-CVE-2026-48592

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027"
          ],
          "packageName": "oban_web",
          "packageURL": "pkg:hex/oban_web",
          "product": "oban_web",
          "programFiles": [
            "lib/oban/web/live/jobs/detail_component.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027:handle_event/3"
            }
          ],
          "vendor": "oban-bg",
          "versions": [
            {
              "lessThan": "2.12.5",
              "status": "affected",
              "version": "2.12.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027"
          ],
          "packageName": "oban-bg/oban_web",
          "packageURL": "pkg:github/oban-bg/oban_web",
          "product": "oban_web",
          "programFiles": [
            "lib/oban/web/live/jobs/detail_component.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027:handle_event/3"
            }
          ],
          "repo": "https://github.com/oban-bg/oban_web.git",
          "vendor": "oban-bg",
          "versions": [
            {
              "lessThan": "ab3c5d1d3eba06c62045f16f2cd7781c7752e248",
              "status": "affected",
              "version": "a17bc8c31286c9d516e2892cf5483d1c95e65d6c",
              "versionType": "git"
            }
          ]
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Authorization vulnerability in oban-bg oban_web (\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027 modules) allows unauthorized job worker substitution.\n\nThe handle_event(\"save-job\", ...) handler in \u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027 does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller\u0027s privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job\u0027s worker field with any other existing Oban.Worker module in the application. On the job\u0027s next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.\n\nThis issue affects oban_web: from 2.12.0 before 2.12.5."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de autorizaci\u00f3n faltante en oban-bg oban_web (m\u00f3dulos \u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027) permite la sustituci\u00f3n no autorizada del trabajador de tareas.\n\nEl gestor handle_event(\"save-job\", ...) en \u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027 no realiza una verificaci\u00f3n de autorizaci\u00f3n, a diferencia de los gestores hermanos de cancelaci\u00f3n, eliminaci\u00f3n y reintento, los cuales todos verifican los privilegios del llamador a trav\u00e9s de can?/2. Un usuario autenticado con acceso de :solo_lectura puede enviar un evento WebSocket forjado de LiveView de save-job para sobrescribir el campo de trabajador de una tarea con cualquier otro m\u00f3dulo Oban.Worker existente en la aplicaci\u00f3n. En el siguiente intento de ejecuci\u00f3n de la tarea, Oban invocar\u00e1 perform/1 en el m\u00f3dulo elegido por el atacante en lugar del previsto.\n\nEste problema afecta a oban_web: desde 2.12.0 antes de 2.12.5."
    }
  ],
  "id": "CVE-2026-48592",
  "lastModified": "2026-07-24T11:10:00.170",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48592",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-26T20:46:44.585227Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-26T21:16:41.707",
  "references": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://cna.erlef.org/cves/CVE-2026-48592.html"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33"
    },
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48592"
    }
  ],
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary"
    }
  ]
}

GHSA-389X-RGXR-8M33

Vulnerability from github – Published: 2026-06-30 18:33 – Updated: 2026-06-30 18:33

Summary

oban_web missing authorization check on `save-job` event handler

Details

Summary

oban_web 2.12.0 through the current unpatched release exposes a save-job LiveView event handler that performs no authorization check, allowing any authenticated user (including those with :read_only access) to overwrite a queued job's worker field with any other Oban.Worker module present in the application. On the job's next execution attempt, Oban dispatches perform/1 on the attacker-chosen module instead of the intended one.

Details

In lib/oban/web/live/jobs/detail_component.ex, the sibling event handlers for destructive actions all gate their side effects via can?/2 (cancel, delete, retry). The handle_event("save-job", params, socket) clause added in 2.12.0 has no equivalent guard. It builds a changes map from the client-supplied params (including worker, queue, priority, max_attempts, scheduled_at, tags, args) and unconditionally dispatches {:update_job, job, changes} to the parent LiveView, which writes the changes to the database.

The disabled attribute on the edit fieldset and button in the rendered HTML is advisory only. The Phoenix LiveView channel dispatches any phx-event pushed over the authenticated WebSocket regardless of what the DOM looks like, so the attacker pushes the event directly over the WebSocket without touching the UI.

The attacker is constrained to substituting an existing Oban.Worker module already loaded in the application (no code injection). The impact depends on what workers are available in the target application.

PoC

Obtain an authenticated session with at minimum :read_only access to the Oban.Web dashboard.
Open any job's detail panel to obtain its job ID.
Push a forged save-job event over the LiveView WebSocket with "worker" set to the desired target module name.
The server accepts the payload and updates the job row. On its next execution attempt, Oban invokes perform/1 on the attacker-chosen module.

Impact

CVSS 4.0 score 5.3 (Medium). Any application running oban_web >= 2.12.0 that exposes the dashboard to users with less than full job-management privileges is affected. The only precondition is an authenticated session with :read_only access or higher.

References

Introduction commit: https://github.com/oban-bg/oban_web/commit/a17bc8c31286c9d516e2892cf5483d1c95e65d6c
Patch commit: https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "oban_web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.12.0"
            },
            {
              "fixed": "2.12.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48592"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-30T18:33:20Z",
    "nvd_published_at": "2026-05-26T21:16:41Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`oban_web` 2.12.0 through the current unpatched release exposes a `save-job` LiveView event handler that performs no authorization check, allowing any authenticated user (including those with `:read_only` access) to overwrite a queued job\u0027s `worker` field with any other `Oban.Worker` module present in the application. On the job\u0027s next execution attempt, Oban dispatches `perform/1` on the attacker-chosen module instead of the intended one.\n\n### Details\n\nIn `lib/oban/web/live/jobs/detail_component.ex`, the sibling event handlers for destructive actions all gate their side effects via `can?/2` (cancel, delete, retry). The `handle_event(\"save-job\", params, socket)` clause added in 2.12.0 has no equivalent guard. It builds a `changes` map from the client-supplied params (including `worker`, `queue`, `priority`, `max_attempts`, `scheduled_at`, `tags`, `args`) and unconditionally dispatches `{:update_job, job, changes}` to the parent LiveView, which writes the changes to the database.\n\nThe `disabled` attribute on the edit fieldset and button in the rendered HTML is advisory only. The Phoenix LiveView channel dispatches any `phx-event` pushed over the authenticated WebSocket regardless of what the DOM looks like, so the attacker pushes the event directly over the WebSocket without touching the UI.\n\nThe attacker is constrained to substituting an existing `Oban.Worker` module already loaded in the application (no code injection). The impact depends on what workers are available in the target application.\n\n### PoC\n\n1. Obtain an authenticated session with at minimum `:read_only` access to the Oban.Web dashboard.\n2. Open any job\u0027s detail panel to obtain its job ID.\n3. Push a forged `save-job` event over the LiveView WebSocket with `\"worker\"` set to the desired target module name.\n4. The server accepts the payload and updates the job row. On its next execution attempt, Oban invokes `perform/1` on the attacker-chosen module.\n\n### Impact\n\nCVSS 4.0 score 5.3 (Medium). Any application running `oban_web` \u003e= 2.12.0 that exposes the dashboard to users with less than full job-management privileges is affected. The only precondition is an authenticated session with `:read_only` access or higher.\n\n## References\n\n* Introduction commit: https://github.com/oban-bg/oban_web/commit/a17bc8c31286c9d516e2892cf5483d1c95e65d6c\n* Patch commit: https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248",
  "id": "GHSA-389x-rgxr-8m33",
  "modified": "2026-06-30T18:33:20Z",
  "published": "2026-06-30T18:33:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48592"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-48592.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/oban-bg/oban_web"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48592"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "oban_web missing authorization check on `save-job` event handler"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-48592 (GCVE-0-2026-48592)

FKIE_CVE-2026-48592

GHSA-389X-RGXR-8M33

Summary

Details

PoC

Impact

References

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour