ash-project ash_oban 0.2.5/0.8.13 Trigger Argument AshOban.build_trigger args authorization

Summaryinfo

A vulnerability was found in ash-project ash_oban 0.2.5/0.8.13. It has been declared as critical. This affects the function AshOban.build_trigger of the component Trigger Argument Handler. Such manipulation of the argument args leads to authorization. This vulnerability is referenced as CVE-2026-78038. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in ash-project ash_oban 0.2.5/0.8.13 and classified as critical. Affected by this issue is the function AshOban.build_trigger of the component Trigger Argument Handler. The manipulation of the argument args with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :args option of AshOban.build_trigger/3 to retarget an update or destroy trigger at another record, including across tenants. build_trigger/3 builds the trusted job arguments with atom keys (:primary_key, :tenant, :action_arguments) and merges the caller's :args underneath so the trusted values win on collision. Because Oban job arguments round-trip through JSON, the caller's keys arrive as strings, so Map.merge sees no collision and both keys survive. When the job is persisted the JSON object is de-duplicated keeping the last (string) key, and the worker reads the caller's value. The documentation describes :args as unable to affect the action, so an application that forwards user input into it for uniqueness scoping is exposed to authorization bypass and tenant isolation breaks. This issue affects ash_oban: from 0.2.5 before 0.8.14.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-78038 since 08/28/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

Upgrading to version 0.8.14 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Project Management Software

Vendor

• ash-project

Name

• ash_oban

Version

• 0.2.5
• 0.8.13

Website

• Product: https://github.com/ash-project/ash_oban/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion