https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 21:30:04 +0000 https://vulnerability.circl.lu/vuln/cve-2026-78038 <p><strong>Affected:</strong> ash-project ash_oban</p> <p>Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :args option of AshOban.build_trigger/3 to retarget an update or destroy trigger at another record, including across tenants.</p> <p>build_trigger/3 builds the trusted job arguments with atom keys (:primary_key, :tenant, :action_arguments) and merges the caller&#39;s :args underneath so the trusted values win on collision. Because Oban job arguments round-trip through JSON, the caller&#39;s keys arrive as strings, so Map.merge sees no collision and both keys survive. When the job is persisted the JSON object is de-duplicated keeping the last (string) key, and the worker reads the caller&#39;s value. The documentation describes :args as unable to affect the action, so an application that forwards user input into it for uniqueness scoping is exposed to authorization bypass and tenant isolation breaks.</p> <p>This issue affects ash_oban: from 0.2.5 before 0.8.14.</p> <p><strong>Affected:</strong> ash-project ash_oban</p> <p>Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in ash-project ash_oban allows a user whose input reaches the :args option of AshOban.build_trigger/3 to retarget an update or destroy trigger at another record, including across tenants.</p> <p>build_trigger/3 builds the trusted job arguments with atom keys (:primary_key, :tenant, :action_arguments) and merges the caller&#39;s :args underneath so the trusted values win on collision. Because Oban job arguments round-trip through JSON, the caller&#39;s keys arrive as strings, so Map.merge sees no collision and both keys survive. When the job is persisted the JSON object is de-duplicated keeping the last (string) key, and the worker reads the caller&#39;s value. The documentation describes :args as unable to affect the action, so an application that forwards user input into it for uniqueness scoping is exposed to authorization bypass and tenant isolation breaks.</p> <p>This issue affects ash_oban: from 0.2.5 before 0.8.14.</p> https://vulnerability.circl.lu/vuln/cve-2026-78038