PT-2026-43407 · Oban Web · Oban Web

Jonatan Männchen + 2 · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-48592

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions oban web versions 2.12.0 through 2.12.4

Description A missing authorization issue in the Elixir.Oban.Web.Jobs.DetailComponent module allows unauthorized job worker substitution. The handle event("save-job", ...) handler fails to perform authorization checks, whereas other handlers like cancel, delete, and retry verify privileges using can?/2. An authenticated user with :read only access can send a forged save-job LiveView WebSocket event to overwrite a job's worker field with any other existing Oban.Worker module in the application. Consequently, during the next execution attempt, Oban will invoke the perform/1 function on the module chosen by the attacker instead of the intended one. This occurs when the Oban.Web dashboard is deployed and accessible to users with limited job-management privileges.

Recommendations Update to version 2.12.5.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-48592

GHSA-389X-RGXR-8M33

Affected Products

Oban Web

References · 6

• https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248 · Patch
• https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33 · Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-48592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48592 · Security Note
• https://cna.erlef.org/cves/CVE-2026-48592.html · Note
• https://hex.pm/packages/oban_web · Note