1 matches found
oban_web missing authorization check on `save-job` event handler
Summary obanweb 2.12.0 through the current unpatched release exposes a save-job LiveView event handler that performs no authorization check, allowing any authenticated user including those with :readonly access to overwrite a queued job's worker field with any other Oban.Worker module present in...
5.3CVSS6AI score0.00559EPSS
SaveExploits0References6Affected Software1
20