CVE-2026-48592: Oban Web Auth Bypass Vulnerability

CVE-2026-48592 Overview

CVE-2026-48592 is a missing authorization vulnerability [CWE-862] in the oban-bg/oban_web library, a web dashboard for the Oban background job framework in Elixir. The Elixir.Oban.Web.Jobs.DetailComponent module fails to verify caller privileges in its handle_event("save-job", ...) handler. An authenticated user with :read_only access can forge a save-job LiveView WebSocket event to overwrite a job's worker field with any existing Oban.Worker module in the application. On the job's next execution, Oban invokes perform/1 on the attacker-chosen module instead of the intended one. The flaw affects oban_web versions from 2.12.0 before 2.12.5.

Critical Impact
A read-only authenticated user can substitute job workers, causing Oban to execute unintended worker modules with attacker-controlled job arguments on the next scheduled run.

Affected Products

oban_web 2.12.0 through 2.12.4
Elixir applications embedding the Oban Web dashboard
Phoenix LiveView deployments exposing Oban Web to multi-tenant users

Discovery Timeline

2026-05-26 - CVE-2026-48592 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-48592

Vulnerability Analysis

The vulnerability resides in the LiveView event handler that processes job edits in the Oban Web dashboard. Sibling handlers for cancel, delete, and retry operations call the can?/2 resolver to verify caller privileges before mutating job state. The save-job handler omits this check entirely. As a result, the server accepts the WebSocket event from any authenticated client session, regardless of the :read_only access tier assigned by the host application.

An attacker leverages this gap by crafting a forged LiveView payload that targets a queued or scheduled Oban job. The payload supplies a worker value pointing to a different Oban.Worker module already loaded in the BEAM runtime. Oban persists the modified record, and the next dispatch invokes perform/1 on the substituted module using the original job's arguments. Impact depends on which worker modules exist in the application and what side effects they perform when called with adversarial arguments.

Root Cause

The root cause is an authorization check omission in lib/oban/web/live/jobs/detail_component.ex. The component renders the edit form without disabling it for users lacking update privileges, and the corresponding server-side event handler trusts the inbound event without invoking the resolver's permission predicate. The patch introduces a new :update_jobs action in the resolver and gates both the form and the handler on can?(:update_jobs, @access).

Attack Vector

Exploitation requires network access to the Oban Web dashboard and valid authenticated credentials at the :read_only privilege level. The attacker opens the dashboard, establishes a LiveView WebSocket, and pushes a forged save-job event referencing a target job ID and a substitute worker module name. No user interaction from a privileged account is required.

text

         </button>
 
         <div id="edit-content" class={["mt-3", if(executing?(@job), do: "hidden")]}>
-          <fieldset disabled={executing?(@job)}>
+          <fieldset disabled={executing?(@job) or not can?(:update_jobs, @access)}>
             <form
               id="job-edit-form"
               class="grid grid-cols-4 gap-4 bg-gray-50 dark:bg-gray-800 rounded-md p-4"

Source: GitHub Commit ab3c5d1 — the patch disables the edit fieldset and adds :update_jobs as a new authorization qualifier in lib/oban/web/resolver.ex.

Detection Methods for CVE-2026-48592

Indicators of Compromise

Oban job records whose worker column changed after enqueue but before execution, without an accompanying admin audit entry.
LiveView session logs containing save-job events originating from accounts mapped to the :read_only access tier.
Unexpected perform/1 invocations on worker modules that were not originally enqueued, visible in Oban telemetry or application logs.

Detection Strategies

Enable Oban telemetry events ([:oban, :job, :start] and [:oban, :job, :exception]) and alert when the executed worker differs from the worker recorded at insertion time.
Add Phoenix LiveView instrumentation to log every save-job event with the session's user ID and access role, then flag events from non-privileged roles.
Review the oban_jobs table for updated_at values that postdate inserted_at on jobs in the available or scheduled state without a legitimate admin action.

Monitoring Recommendations

Forward Phoenix and Oban telemetry to a centralized log platform and build correlation rules joining LiveView events to job mutations.
Alert on any deployment running oban_web versions between 2.12.0 and 2.12.4 inclusive.
Track failed authorization attempts post-patch to identify accounts probing for the previously vulnerable handler.

How to Mitigate CVE-2026-48592

Immediate Actions Required

Upgrade oban_web to version 2.12.5 or later in mix.exs and redeploy all Elixir nodes serving the dashboard.
Audit Oban job history for unexpected worker substitutions since the deployment of any 2.12.x release prior to 2.12.5.
Restrict network access to the Oban Web dashboard so only trusted administrators can reach the LiveView endpoint.

Patch Information

The fix is delivered in oban_web 2.12.5 via commit ab3c5d1d3eba06c62045f16f2cd7781c7752e248. The patch adds a new :update_jobs qualifier to the resolver type, gates the job edit form on can?(:update_jobs, @access), and rejects unauthorized save-job events server-side. See the GitHub Security Advisory GHSA-389x-rgxr-8m33 and the Erlang Ecosystem Foundation CNA record for full advisory details.

Workarounds

Remove or hide the Oban Web dashboard route from users with :read_only access until the upgrade lands.
Implement a custom Plug in front of the LiveView socket that strips save-job events from non-admin sessions.
Place the dashboard behind an SSO proxy that enforces administrator-only group membership.

bash

# Update the dependency in mix.exs and recompile
# {:oban_web, "~> 2.12.5"}
mix deps.update oban_web
mix deps.get
mix compile