EUVD-2026-68185Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via web app input but requires specific application design flaw (AC:H); cross-tenant record manipulation yields scope change with high integrity impact.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :args option of AshOban.build_trigger/3 to retarget an update or destroy trigger at another record, including across tenants.
build_trigger/3 builds the trusted job arguments with atom keys (:primary_key, :tenant, :action_arguments) and merges the caller's :args underneath so the trusted values win on collision. Because Oban job arguments round-trip through JSON, the caller's keys arrive as strings, so Map.merge sees no collision and both keys survive. When the job is persisted the JSON object is de-duplicated keeping the last (string) key, and the worker reads the caller's value. The documentation describes :args as unable to affect the action, so an application that forwards user input into it for uniqueness scoping is exposed to authorization bypass and tenant isolation breaks.
This issue affects ash_oban: from 0.2.5 before 0.8.14.
AnalysisAI
AshOban versions 0.2.5 through 0.8.13 expose an authorization bypass and tenant isolation break in the build_trigger/3 function, allowing any user whose input reaches the :args option to retarget update or destroy background jobs at arbitrary records - including records belonging to other tenants. The root cause is an Elixir atom-vs-string key collision: trusted job fields are stored as atom keys, user-supplied :args arrive as string keys after JSON round-tripping, Map.merge sees no collision and both survive, and JSON serialization then keeps the last (string) key when the job is persisted, causing the worker to read attacker-controlled values. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific preconditions: first, the application must pass user-controlled data into the :args option of AshOban.build_trigger/3 - deployments that construct :args exclusively from server-side trusted data are not vulnerable; second, the trigger must be an update or destroy trigger (not a create trigger), as the primary_key routing only applies to record-targeted operations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.9 with AV:L and AT:P correctly signals that this is not a default-exploit-all-instances vulnerability - exploitation requires a specific application design flaw where user-controlled input flows into the :args parameter of build_trigger/3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ash_oban to version 0.8.14 or later, which introduces the remove_reserved_args/1 function that strips the reserved keys 'primary_key', 'metadata', 'action_arguments', 'tenant', and 'actor' from both the extra_args map and the caller-supplied :args map before any merging occurs, closing the atom/string collision bypass. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today