Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.3
Unauthorized Job Changes in oban_web
published 5 months ago
Summary
An attacker can change the worker assigned to a job, potentially causing incorrect results or errors. This affects oban_web versions 2.12.0 to 2.12.4. If you use oban_web, ensure that users with limited access cannot access the job management dashboard.
What to do
- Update sorentwo oban_web to version 2.12.5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Hex | sorentwo | oban_web |
>= 2.12.0, < 2.12.5 Fix: upgrade to 2.12.5
|
Original advisory text
Missing authorization check on save-job event handler in oban_web
## Summary
Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution.
The handle_event("save-job", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller's privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job's worker field with any other existing Oban.Worker module in the application. On the job's next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.
This issue affects oban_web: from 2.12.0 before 2.12.5.
## Configuration
The Oban.Web dashboard must be deployed and accessible to users with less than full job-management privileges (e.g. :read_only).
Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution.
The handle_event("save-job", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller's privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job's worker field with any other existing Oban.Worker module in the application. On the job's next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.
This issue affects oban_web: from 2.12.0 before 2.12.5.
## Configuration
The Oban.Web dashboard must be deployed and accessible to users with less than full job-management privileges (e.g. :read_only).
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-862Missing Authorization
Timeline
Published26 May 2026
Updated26 May 2026
First seen26 May 2026
Track software like this
Free during beta