« Volver al listado

CVE-2026-48592

Estado: AplazadaMedia (5.3)—

Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution.

The handle_event("save-job", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller's privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job's worker field with any other existing Oban.Worker module in the application. On the job's next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.

Leer descripción completaMostrar menos

This issue affects oban_web: from 2.12.0 before 2.12.5.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Oban — Oban WEBAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-48592",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48592",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-26T20:46:44.585227Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"
          ],
          "vendor": "oban-bg",
          "modules": [
            "'Elixir.Oban.Web.Jobs.DetailComponent'"
          ],
          "product": "oban_web",
          "versions": [
            {
              "status": "affected",
              "version": "2.12.0",
              "lessThan": "2.12.5",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:hex/oban_web",
          "packageName": "oban_web",
          "programFiles": [
            "lib/oban/web/live/jobs/detail_component.ex"
          ],
          "collectionURL": "https://repo.hex.pm",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "'Elixir.Oban.Web.Jobs.DetailComponent':handle_event/3"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:oban_web_project:oban_web:*:*:*:*:*:*:*:*"
          ],
          "repo": "https://github.com/oban-bg/oban_web.git",
          "vendor": "oban-bg",
          "modules": [
            "'Elixir.Oban.Web.Jobs.DetailComponent'"
          ],
          "product": "oban_web",
          "versions": [
            {
              "status": "affected",
              "version": "a17bc8c31286c9d516e2892cf5483d1c95e65d6c",
              "lessThan": "ab3c5d1d3eba06c62045f16f2cd7781c7752e248",
              "versionType": "git"
            }
          ],
          "packageURL": "pkg:github/oban-bg/oban_web",
          "packageName": "oban-bg/oban_web",
          "programFiles": [
            "lib/oban/web/live/jobs/detail_component.ex"
          ],
          "collectionURL": "https://github.com",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "'Elixir.Oban.Web.Jobs.DetailComponent':handle_event/3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-26T21:16:41.707",
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-48592.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/oban-bg/oban_web/commit/ab3c5d1d3eba06c62045f16f2cd7781c7752e248",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/oban-bg/oban_web/security/advisories/GHSA-389x-rgxr-8m33",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48592",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthorized job worker substitution.\n\nThe handle_event(\"save-job\", ...) handler in 'Elixir.Oban.Web.Jobs.DetailComponent' does not perform an authorization check, unlike the sibling cancel, delete, and retry handlers which all verify the caller's privileges via can?/2. An authenticated user with :read_only access can push a forged save-job LiveView WebSocket event to overwrite a job's worker field with any other existing Oban.Worker module in the application. On the job's next execution attempt, Oban will invoke perform/1 on the attacker-chosen module instead of the intended one.\n\nThis issue affects oban_web: from 2.12.0 before 2.12.5."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de autorización faltante en oban-bg oban_web (módulos 'Elixir.Oban.Web.Jobs.DetailComponent') permite la sustitución no autorizada del trabajador de tareas.\n\nEl gestor handle_event(\"save-job\", ...) en 'Elixir.Oban.Web.Jobs.DetailComponent' no realiza una verificación de autorización, a diferencia de los gestores hermanos de cancelación, eliminación y reintento, los cuales todos verifican los privilegios del llamador a través de can?/2. Un usuario autenticado con acceso de :solo_lectura puede enviar un evento WebSocket forjado de LiveView de save-job para sobrescribir el campo de trabajador de una tarea con cualquier otro módulo Oban.Worker existente en la aplicación. En el siguiente intento de ejecución de la tarea, Oban invocará perform/1 en el módulo elegido por el atacante en lugar del previsto.\n\nEste problema afecta a oban_web: desde 2.12.0 antes de 2.12.5."
    }
  ],
  "lastModified": "2026-07-24T11:10:00.170",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}