PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48592 oban-bg CVE debrief

A missing authorization check in Oban Web's job detail component allows read-only users to substitute job workers. The `handle_event/3` callback for the `save-job` event in `Elixir.Oban.Web.Jobs.DetailComponent` fails to verify user privileges via the `can?/2` function, unlike sibling handlers for cancel, delete, and retry operations. An authenticated attacker with `:read_only` access can forge a LiveView WebSocket event to overwrite a job's `worker` field with any existing `Oban.Worker` module in the application. When the job next executes, Oban invokes `perform/1` on the attacker-selected module instead of the intended worker. This affects oban_web versions 2.12.0 through 2.12.4.

Vendor
oban-bg
Product
oban_web
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-07-23
Advisory published
2026-05-26
Advisory updated
2026-07-23

Who should care

Organizations running Oban Web versions 2.12.0-2.12.4 with multi-user dashboard access, particularly those granting read-only permissions to operational or support staff. Elixir/Phoenix applications using Oban for background job processing where worker modules perform sensitive or privileged operations.

Technical summary

The vulnerability stems from inconsistent authorization enforcement across event handlers in Oban Web's job management interface. While `cancel`, `delete`, and `retry` operations validate user privileges through a `can?/2` helper, the `save-job` handler lacks this verification. This asymmetry permits privilege escalation from read-only access to arbitrary worker execution. The attack vector requires authenticated WebSocket access to the LiveView dashboard, making it exploitable by any user with dashboard visibility. The impact is bounded by the attacker's ability to only select from existing worker modules rather than arbitrary code execution, though this still enables unauthorized business logic invocation and potential data manipulation through alternative worker implementations.

Defensive priority

medium

Recommended defensive actions

  • Upgrade oban_web to version 2.12.5 or later
  • Review application logs for unauthorized job worker modifications between 2026-05-26 and patch deployment
  • Audit user access levels to ensure least-privilege principles for Oban Web dashboard access
  • Implement network segmentation to limit LiveView WebSocket exposure to authorized administrative hosts only
  • Monitor for anomalous job execution patterns indicating worker substitution

Evidence notes

CVE description confirms the vulnerability exists in the `handle_event/3` callback for `save-job` events within `Elixir.Oban.Web.Jobs.DetailComponent`. The fix commit (ref-5) adds authorization checks to align with sibling handlers. GitHub Security Advisory (ref-6) provides vendor acknowledgment. CWE-862 (Missing Authorization) is assigned per source metadata.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48592 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48592

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48592 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48592

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://cna.erlef.org/cves/CVE-2026-48592.html

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

  • Source reference

    Unverified legacy reference

    URL: https://osv.dev/vulnerability/EEF-CVE-2026-48592

    6b3ad84c-e1a6-4bf7-a703-f496b71e49db

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.