CVE-2026-48592 json
Missing authorization check on save-job event handler in oban_web
published 5mo ago modified 2mo ago also EEF-CVE-2026-48592 , EUVD-2026-31975 , GHSA-389x-rgxr-8m33
- cvss
- 5.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution.
The handle_event("save-job", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller's privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job's worker field with any other existing Oban.Worker module in the application. On the job's next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.
This issue affects oban_web: from 2.12.0 before 2.12.5.
Patch / fix
Is CVE-2026-48592 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5mo ago
Exploit prediction
0.50% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | oban_web | >=2.12.0, <2.12.5 |
2.12.5 |
Affected products
- oban-bg oban_web
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248
patch, web
-
github.com
/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33
vendor-advisory, related, web, advisory
-
cna.erlef.org
/cves/CVE-2026-48592.html
related, web
-
osv.dev
/vulnerability/EEF-CVE-2026-48592
related, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-48592
advisory
-
github.com
/oban-bg/oban_web
package
-
hex.pm
/packages/oban_web
package
Sources
- CVE List CVE-2026-48592
- GitHub Advisory GHSA-389x-rgxr-8m33
- NVD CVE-2026-48592
- OSV EEF-CVE-2026-48592
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.