5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48592

CVE-2026-48592: Missing authorization check on save-job event handler in oban_web

Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution.

The handle_event("save-job", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller's privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job's worker field with any other existing Oban.Worker module in the application. On the job's next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.

This issue affects oban_web: from 2.12.0 before 2.12.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48592

CVE-2026-48592:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
oban_web	erlang	>= 2.12.0, < 2.12.5	2.12.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a missing authorization check in the oban_web LiveView component that handles job updates. The root cause lies in the handle_event function for the "save-job" event within the Oban.Web.Jobs.DetailComponent module. This function, introduced in commit a17bc8c, fails to validate whether the user has the necessary permissions to modify a job. It processes any received parameters and sends an asynchronous :update_job message to its parent LiveView, Oban.Web.JobsPage.

The handle_info function in the Oban.Web.JobsPage module receives this message and, trusting its origin, proceeds to update the job in the database using Oban.update_job/3. An attacker with only :read_only access can exploit this flaw by sending a crafted save-job event directly over the authenticated WebSocket. This bypasses any UI-level restrictions and allows them to change a job's properties, most critically the worker module, leading to a privilege escalation where their chosen worker is executed on the job's next run.

The patch in commit ab3c5d1 addresses the vulnerability by adding the necessary authorization check, can?(:update_jobs, @access), to the DetailComponent.handle_event function, ensuring that only privileged users can modify jobs.

Vulnerable functions

DetailComponent.handle_event

lib/oban/web/live/jobs/detail_component.ex

This function is the entry point for the vulnerability. It handles the `save-job` event from a client without verifying if the user has the permission to perform this action. It processes user-controlled parameters to build a `changes` map, which is then sent to the parent LiveView to update the job. This allows a low-privileged user to modify job details, such as the `worker` that will process the job.

JobsPage.handle_info

lib/oban/web/pages/jobs_page.ex

This function is a critical part of the exploit chain. It receives the `:update_job` message containing attacker-controlled data from the `DetailComponent`. It then calls `Oban.update_job/3`, which writes the malicious changes to the database. While the vulnerability originates in the caller, this function is the one that directly causes the unauthorized state change and would appear in a runtime profile during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.