CVE-2026-48592

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48592", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-05-22T09:36:56.834Z", "datePublished": "2026-05-26T19:46:48.611Z", "dateUpdated": "2026-05-27T15:41:23.434Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Oban.Web.Jobs.DetailComponent'"], "packageName": "oban_web", "packageURL": "pkg:hex/oban_web", "product": "oban_web", "programFiles": ["lib/oban/web/live/jobs/detail_component.ex"], "programRoutines": [{"name": "'Elixir.Oban.Web.Jobs.DetailComponent':handle_event/3"}], "vendor": "oban-bg", "versions": [{"lessThan": "2.12.5", "status": "affected", "version": "2.12.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Oban.Web.Jobs.DetailComponent'"], "packageName": "oban-bg/oban_web", "packageURL": "pkg:github/oban-bg/oban_web", "product": "oban_web", "programFiles": ["lib/oban/web/live/jobs/detail_component.ex"], "programRoutines": [{"name": "'Elixir.Oban.Web.Jobs.DetailComponent':handle_event/3"}], "repo": "https://github.com/oban-bg/oban_web.git", "vendor": "oban-bg", "versions": [{"lessThan": "ab3c5d1d3eba06c62045f16f2cd7781c7752e248", "status": "affected", "version": "a17bc8c31286c9d516e2892cf5483d1c95e65d6c", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The Oban.Web dashboard must be deployed and accessible to users with less than full job-management privileges (e.g. <tt>:read_only</tt>).</p>"}], "value": "The Oban.Web dashboard must be deployed and accessible to users with less than full job-management privileges (e.g. :read_only)."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.12.5", "versionStartIncluding": "2.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Parker Selbert"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Missing Authorization vulnerability in oban-bg oban_web (<tt>'Elixir.Oban.Web.Jobs.DetailComponent'</tt> modules) allows unauthorized job worker substitution.</p><p>The <tt>handle_event(\"save-job\", ...)</tt> handler in <tt>'Elixir.Oban.Web.Jobs.DetailComponent'</tt> does not perform an authorization check, unlike the sibling <tt>cancel</tt>, <tt>delete</tt>, and <tt>retry</tt> handlers which all verify the caller's privileges via <tt>can?/2</tt>. An authenticated user with <tt>:read_only</tt> access can push a forged <tt>save-job</tt> LiveView WebSocket event to overwrite a job's <tt>worker</tt> field with any other existing <tt>Oban.Worker</tt> module in the application. On the job's next execution attempt, Oban will invoke <tt>perform/1</tt> on the attacker-chosen module instead of the intended one.</p><p>This issue affects oban_web: from 2.12.0 before 2.12.5.</p>"}], "value": "Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution.\n\nThe handle_event(\"save-job\", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller's privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job's worker field with any other existing Oban.Worker module in the application. On the job's next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.\n\nThis issue affects oban_web: from 2.12.0 before 2.12.5."}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"cvssV4_0": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.3, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-05-27T15:41:23.434Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-48592.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48592"}, {"tags": ["patch"], "url": "https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248"}], "source": {"discovery": "EXTERNAL"}, "title": "Missing authorization check on save-job event handler in oban_web", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T20:46:44.585227Z", "id": "CVE-2026-48592", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T20:46:50.037Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48592", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T20:46:44.585227Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T20:46:47.428Z"}}], "cna": {"title": "Missing authorization check on save-job event handler in oban_web", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "remediation developer", "value": "Parker Selbert"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"], "vendor": "oban-bg", "modules": ["'Elixir.Oban.Web.Jobs.DetailComponent'"], "product": "oban_web", "versions": [{"status": "affected", "version": "2.12.0", "lessThan": "2.12.5", "versionType": "semver"}], "packageURL": "pkg:hex/oban_web", "packageName": "oban_web", "programFiles": ["lib/oban/web/live/jobs/detail_component.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Oban.Web.Jobs.DetailComponent':handle_event/3"}]}, {"cpes": ["cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"], "repo": "https://github.com/oban-bg/oban_web.git", "vendor": "oban-bg", "modules": ["'Elixir.Oban.Web.Jobs.DetailComponent'"], "product": "oban_web", "versions": [{"status": "affected", "version": "a17bc8c31286c9d516e2892cf5483d1c95e65d6c", "lessThan": "ab3c5d1d3eba06c62045f16f2cd7781c7752e248", "versionType": "git"}], "packageURL": "pkg:github/oban-bg/oban_web", "packageName": "oban-bg/oban_web", "programFiles": ["lib/oban/web/live/jobs/detail_component.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Oban.Web.Jobs.DetailComponent':handle_event/3"}]}], "references": [{"url": "https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-48592.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48592", "tags": ["related"]}, {"url": "https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248", "tags": ["patch"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution.\n\nThe handle_event(\"save-job\", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller's privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job's worker field with any other existing Oban.Worker module in the application. On the job's next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.\n\nThis issue affects oban_web: from 2.12.0 before 2.12.5.", "supportingMedia": [{"type": "text/html", "value": "<p>Missing Authorization vulnerability in oban-bg oban_web (<tt>'Elixir.Oban.Web.Jobs.DetailComponent'</tt> modules) allows unauthorized job worker substitution.</p><p>The <tt>handle_event(\"save-job\", ...)</tt> handler in <tt>'Elixir.Oban.Web.Jobs.DetailComponent'</tt> does not perform an authorization check, unlike the sibling <tt>cancel</tt>, <tt>delete</tt>, and <tt>retry</tt> handlers which all verify the caller's privileges via <tt>can?/2</tt>. An authenticated user with <tt>:read_only</tt> access can push a forged <tt>save-job</tt> LiveView WebSocket event to overwrite a job's <tt>worker</tt> field with any other existing <tt>Oban.Worker</tt> module in the application. On the job's next execution attempt, Oban will invoke <tt>perform/1</tt> on the attacker-chosen module instead of the intended one.</p><p>This issue affects oban_web: from 2.12.0 before 2.12.5.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "configurations": [{"lang": "en", "value": "The Oban.Web dashboard must be deployed and accessible to users with less than full job-management privileges (e.g. :read_only).", "supportingMedia": [{"type": "text/html", "value": "<p>The Oban.Web dashboard must be deployed and accessible to users with less than full job-management privileges (e.g. <tt>:read_only</tt>).</p>", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.12.5", "versionStartIncluding": "2.12.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-05-27T15:41:23.434Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48592", "state": "PUBLISHED", "dateUpdated": "2026-05-27T15:41:23.434Z", "dateReserved": "2026-05-22T09:36:56.834Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-05-26T19:46:48.611Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Oban.Web.Jobs.DetailComponent'"], "packageName": "oban_web", "packageURL": "pkg:hex/oban_web", "product": "oban_web", "programFiles": ["lib/oban/web/live/jobs/detail_component.ex"], "programRoutines": [{"name": "'Elixir.Oban.Web.Jobs.DetailComponent':handle_event/3"}], "vendor": "oban-bg", "versions": [{"lessThan": "2.12.5", "status": "affected", "version": "2.12.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Oban.Web.Jobs.DetailComponent'"], "packageName": "oban-bg/oban_web", "packageURL": "pkg:github/oban-bg/oban_web", "product": "oban_web", "programFiles": ["lib/oban/web/live/jobs/detail_component.ex"], "programRoutines": [{"name": "'Elixir.Oban.Web.Jobs.DetailComponent':handle_event/3"}], "repo": "https://github.com/oban-bg/oban_web.git", "vendor": "oban-bg", "versions": [{"lessThan": "ab3c5d1d3eba06c62045f16f2cd7781c7752e248", "status": "affected", "version": "a17bc8c31286c9d516e2892cf5483d1c95e65d6c", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution.\n\nThe handle_event(\"save-job\", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller's privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job's worker field with any other existing Oban.Worker module in the application. On the job's next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.\n\nThis issue affects oban_web: from 2.12.0 before 2.12.5."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en oban-bg oban_web (m\u00f3dulos 'Elixir.Oban.Web.Jobs.DetailComponent') permite la sustituci\u00f3n no autorizada del trabajador de tareas.\n\nEl gestor handle_event(\"save-job\", ...) en 'Elixir.Oban.Web.Jobs.DetailComponent' no realiza una verificaci\u00f3n de autorizaci\u00f3n, a diferencia de los gestores hermanos de cancelaci\u00f3n, eliminaci\u00f3n y reintento, los cuales todos verifican los privilegios del llamador a trav\u00e9s de can?/2. Un usuario autenticado con acceso de :solo_lectura puede enviar un evento WebSocket forjado de LiveView de save-job para sobrescribir el campo de trabajador de una tarea con cualquier otro m\u00f3dulo Oban.Worker existente en la aplicaci\u00f3n. En el siguiente intento de ejecuci\u00f3n de la tarea, Oban invocar\u00e1 perform/1 en el m\u00f3dulo elegido por el atacante en lugar del previsto.\n\nEste problema afecta a oban_web: desde 2.12.0 antes de 2.12.5."}], "id": "CVE-2026-48592", "lastModified": "2026-07-24T11:10:00.170", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48592", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T20:46:44.585227Z", "version": "2.0.3"}}]}, "published": "2026-05-26T21:16:41.707", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-48592.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48592"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.12.0,2.12.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "oban_web", "source": "cna", "vendor": "oban-bg"}, "product": "oban_web", "vendor": "oban-bg"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a17bc8c31286c9d516e2892cf5483d1c95e65d6c,ab3c5d1d3eba06c62045f16f2cd7781c7752e248)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "oban_web", "source": "cna", "vendor": "oban-bg"}, "product": "oban_web", "vendor": "oban-bg"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "oban_web", "vendor": "oban_web_project"}], "created": "2026-05-26T21:30:16.444710+00:00", "updated": "2026-05-27T10:08:38.236068+00:00", "vendors": ["oban-bg", "oban-bg$PRODUCT$oban_web", "oban_web_project", "oban_web_project$PRODUCT$oban_web"]}