oban_web CVE-2026-48592

oban_web is the Phoenix LiveView-based administrative dashboard for Oban, an Elixir background job processing library. Phoenix LiveView maintains persistent WebSocket connections between browser client and server; all UI interactions - including form submissions - are transmitted as named server-side events over these sockets rather than traditional HTTP requests. This architecture means UI-level controls (e.g., visually disabled form fields) are not security boundaries: a client can send any valid event name directly via the WebSocket. The affected module, Elixir.Oban.Web.Jobs.DetailComponent, handles job editing through handle_event('save-job', params, socket). CWE-862 (Missing Authorization) applies because this handler processes user-supplied parameters and calls send(self(), {:update_job, job, changes}) without first invoking can?(:update_jobs, socket.assigns.access) - a check already used by the cancel, delete, and retry handlers in the same module. The fix, confirmed in commit ab3c5d1d3eba06c62045f16f2cd7781c7752e248, introduces the :update_jobs permission into the resolver and wraps the mutation logic in a can?/2 guard. CPE cpe:2.3:a:oban-bg:oban_web:*:*:*:*:*:*:*:* covers all affected releases from 2.12.0 through 2.12.4.