The oban_web framework contains a missing authorization check in the Elixir.Oban.Web.Jobs.DetailComponent module when processing the "save-job" LiveView event. This omission allows an authenticated user with only :read_only privileges to override the worker module field of an existing job by sending a forged WebSocket event. The result is that the job will later execute code from the attacker‑chosen worker instead of the intended module, potentially exposing business logic or sensitive data. This flaw is a classic instance of CWE‑862: Missing Authorization.

Affected deployments are those running oban_web 2.12.0 through, but not including, 2.12.5. The vulnerability is vendor‑specific to the oban-bg oban_web project and does not impact other versions or unrelated software.

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, yet the ability to replace a job worker with arbitrary code control remains a non‑trivial risk. The likely attack vector requires a network‑bound attacker who can access the LiveView WebSocket and an authenticated account, such as a read‑only user, to craft the malicious event. Consequently, organizations should treat this as a moderate‑risk vulnerability with potential to subvert scheduled background work.