Executive brief
Oban Web is a dashboard for managing background jobs in Elixir applications. A security flaw allows any user with access to the dashboard, even those with read-only permissions, to modify background jobs. An attacker could change which code is executed for a specific job, potentially leading to unauthorized actions or system disruption depending on the available job types.
Technical details
A missing authorization check in the `save-job` LiveView event handler in `lib/oban/web/live/jobs/detail_component.ex` allows authenticated users to bypass intended permission levels. While other destructive actions like cancel or delete are protected by authorization guards, the `save-job` handler unconditionally processes updates. An attacker with at least `:read_only` access can send a forged WebSocket event to overwrite a queued job's `worker` field with any other `Oban.Worker` module available in the application. When the job next executes, the system will run the attacker-selected worker instead of the original one. This is fixed in version 2.12.5.
Affected products
- oban-bg oban_web >= 2.12.0, < 2.12.5
Timeline
- 2026-05-26: disclosed
- 2026-06-30: advisory
- 2026-06-30: patched: Version 2.12.5 released