Vulnerability-Lookup

GHSA-389X-RGXR-8M33

Vulnerability from github – Published: 2026-06-30 18:33 – Updated: 2026-06-30 18:33

Summary

oban_web missing authorization check on `save-job` event handler

Details

Summary

oban_web 2.12.0 through the current unpatched release exposes a save-job LiveView event handler that performs no authorization check, allowing any authenticated user (including those with :read_only access) to overwrite a queued job's worker field with any other Oban.Worker module present in the application. On the job's next execution attempt, Oban dispatches perform/1 on the attacker-chosen module instead of the intended one.

Details

In lib/oban/web/live/jobs/detail_component.ex, the sibling event handlers for destructive actions all gate their side effects via can?/2 (cancel, delete, retry). The handle_event("save-job", params, socket) clause added in 2.12.0 has no equivalent guard. It builds a changes map from the client-supplied params (including worker, queue, priority, max_attempts, scheduled_at, tags, args) and unconditionally dispatches {:update_job, job, changes} to the parent LiveView, which writes the changes to the database.

The disabled attribute on the edit fieldset and button in the rendered HTML is advisory only. The Phoenix LiveView channel dispatches any phx-event pushed over the authenticated WebSocket regardless of what the DOM looks like, so the attacker pushes the event directly over the WebSocket without touching the UI.

The attacker is constrained to substituting an existing Oban.Worker module already loaded in the application (no code injection). The impact depends on what workers are available in the target application.

PoC

Obtain an authenticated session with at minimum :read_only access to the Oban.Web dashboard.
Open any job's detail panel to obtain its job ID.
Push a forged save-job event over the LiveView WebSocket with "worker" set to the desired target module name.
The server accepts the payload and updates the job row. On its next execution attempt, Oban invokes perform/1 on the attacker-chosen module.

Impact

CVSS 4.0 score 5.3 (Medium). Any application running oban_web >= 2.12.0 that exposes the dashboard to users with less than full job-management privileges is affected. The only precondition is an authenticated session with :read_only access or higher.

References

Introduction commit: https://github.com/oban-bg/oban_web/commit/a17bc8c31286c9d516e2892cf5483d1c95e65d6c
Patch commit: https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248

Severity

5.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Hex",
        "name": "oban_web"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.12.0"
            },
            {
              "fixed": "2.12.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48592"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-30T18:33:20Z",
    "nvd_published_at": "2026-05-26T21:16:41Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`oban_web` 2.12.0 through the current unpatched release exposes a `save-job` LiveView event handler that performs no authorization check, allowing any authenticated user (including those with `:read_only` access) to overwrite a queued job\u0027s `worker` field with any other `Oban.Worker` module present in the application. On the job\u0027s next execution attempt, Oban dispatches `perform/1` on the attacker-chosen module instead of the intended one.\n\n### Details\n\nIn `lib/oban/web/live/jobs/detail_component.ex`, the sibling event handlers for destructive actions all gate their side effects via `can?/2` (cancel, delete, retry). The `handle_event(\"save-job\", params, socket)` clause added in 2.12.0 has no equivalent guard. It builds a `changes` map from the client-supplied params (including `worker`, `queue`, `priority`, `max_attempts`, `scheduled_at`, `tags`, `args`) and unconditionally dispatches `{:update_job, job, changes}` to the parent LiveView, which writes the changes to the database.\n\nThe `disabled` attribute on the edit fieldset and button in the rendered HTML is advisory only. The Phoenix LiveView channel dispatches any `phx-event` pushed over the authenticated WebSocket regardless of what the DOM looks like, so the attacker pushes the event directly over the WebSocket without touching the UI.\n\nThe attacker is constrained to substituting an existing `Oban.Worker` module already loaded in the application (no code injection). The impact depends on what workers are available in the target application.\n\n### PoC\n\n1. Obtain an authenticated session with at minimum `:read_only` access to the Oban.Web dashboard.\n2. Open any job\u0027s detail panel to obtain its job ID.\n3. Push a forged `save-job` event over the LiveView WebSocket with `\"worker\"` set to the desired target module name.\n4. The server accepts the payload and updates the job row. On its next execution attempt, Oban invokes `perform/1` on the attacker-chosen module.\n\n### Impact\n\nCVSS 4.0 score 5.3 (Medium). Any application running `oban_web` \u003e= 2.12.0 that exposes the dashboard to users with less than full job-management privileges is affected. The only precondition is an authenticated session with `:read_only` access or higher.\n\n## References\n\n* Introduction commit: https://github.com/oban-bg/oban_web/commit/a17bc8c31286c9d516e2892cf5483d1c95e65d6c\n* Patch commit: https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248",
  "id": "GHSA-389x-rgxr-8m33",
  "modified": "2026-06-30T18:33:20Z",
  "published": "2026-06-30T18:33:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48592"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-48592.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/oban-bg/oban_web"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48592"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "oban_web missing authorization check on `save-job` event handler"
}

CVE-2026-48592 (GCVE-0-2026-48592)

Vulnerability from cvelistv5 – Published: 2026-05-26 19:46 – Updated: 2026-05-27 15:41

Title

Missing authorization check on save-job event handler in oban_web

Summary

Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution. The handle_event("save-job", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller's privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job's worker field with any other existing Oban.Worker module in the application. On the job's next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one. This issue affects oban_web: from 2.12.0 before 2.12.5.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

EEF

References

4 references

URL	Tags
https://github.com/oban-bg/oban_web/security/advi…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-48592.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-48592	related
https://github.com/oban-bg/oban_web/commit/ab3c5d…	patch

Impacted products

2 products

Vendor	Product	Version
oban-bg	oban_web	Affected: 2.12.0 , < 2.12.5 (semver) cpe:2.3:a:oban_web_project:oban_web::::::::
oban-bg	oban_web	Affected: a17bc8c31286c9d516e2892cf5483d1c95e65d6c , < ab3c5d1d3eba06c62045f16f2cd7781c7752e248 (git) cpe:2.3:a:oban_web_project:oban_web::::::::

Credits

Peter Ullrich Parker Selbert Jonatan Männchen / EEF

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48592",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-26T20:46:44.585227Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-26T20:46:50.037Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027"
          ],
          "packageName": "oban_web",
          "packageURL": "pkg:hex/oban_web",
          "product": "oban_web",
          "programFiles": [
            "lib/oban/web/live/jobs/detail_component.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027:handle_event/3"
            }
          ],
          "vendor": "oban-bg",
          "versions": [
            {
              "lessThan": "2.12.5",
              "status": "affected",
              "version": "2.12.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027"
          ],
          "packageName": "oban-bg/oban_web",
          "packageURL": "pkg:github/oban-bg/oban_web",
          "product": "oban_web",
          "programFiles": [
            "lib/oban/web/live/jobs/detail_component.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027:handle_event/3"
            }
          ],
          "repo": "https://github.com/oban-bg/oban_web.git",
          "vendor": "oban-bg",
          "versions": [
            {
              "lessThan": "ab3c5d1d3eba06c62045f16f2cd7781c7752e248",
              "status": "affected",
              "version": "a17bc8c31286c9d516e2892cf5483d1c95e65d6c",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe Oban.Web dashboard must be deployed and accessible to users with less than full job-management privileges (e.g. \u003ctt\u003e:read_only\u003c/tt\u003e).\u003c/p\u003e"
            }
          ],
          "value": "The Oban.Web dashboard must be deployed and accessible to users with less than full job-management privileges (e.g. :read_only)."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.12.5",
                  "versionStartIncluding": "2.12.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Parker Selbert"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMissing Authorization vulnerability in oban-bg oban_web (\u003ctt\u003e\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027\u003c/tt\u003e modules) allows unauthorized job worker substitution.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003ehandle_event(\"save-job\", ...)\u003c/tt\u003e handler in \u003ctt\u003e\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027\u003c/tt\u003e does not perform an authorization check, unlike the sibling \u003ctt\u003ecancel\u003c/tt\u003e, \u003ctt\u003edelete\u003c/tt\u003e, and \u003ctt\u003eretry\u003c/tt\u003e handlers which all verify the caller\u0027s privileges via \u003ctt\u003ecan?/2\u003c/tt\u003e. An authenticated user with \u003ctt\u003e:read_only\u003c/tt\u003e access can push a forged \u003ctt\u003esave-job\u003c/tt\u003e LiveView WebSocket event to overwrite a job\u0027s \u003ctt\u003eworker\u003c/tt\u003e field with any other existing \u003ctt\u003eOban.Worker\u003c/tt\u003e module in the application. On the job\u0027s next execution attempt, Oban will invoke \u003ctt\u003eperform/1\u003c/tt\u003e on the attacker-chosen module instead of the intended one.\u003c/p\u003e\u003cp\u003eThis issue affects oban_web: from 2.12.0 before 2.12.5.\u003c/p\u003e"
            }
          ],
          "value": "Missing Authorization vulnerability in oban-bg oban_web (\u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027 modules) allows unauthorized job worker substitution.\n\nThe handle_event(\"save-job\", ...) handler in \u0027Elixir.Oban.Web.Jobs.DetailComponent\u0027 does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller\u0027s privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job\u0027s worker field with any other existing Oban.Worker module in the application. On the job\u0027s next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.\n\nThis issue affects oban_web: from 2.12.0 before 2.12.5."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T15:41:23.434Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-48592.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48592"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Missing authorization check on save-job event handler in oban_web",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-48592",
    "datePublished": "2026-05-26T19:46:48.611Z",
    "dateReserved": "2026-05-22T09:36:56.834Z",
    "dateUpdated": "2026-05-27T15:41:23.434Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-389X-RGXR-8M33

Summary

Details

PoC

Impact

References

CVE-2026-48592 (GCVE-0-2026-48592)

Tags

Sightings

Nomenclature