A user can manipulate the :args supplied to AshOban.build_trigger/3, causing user-provided :primary_key and :tenant values to overwrite the trusted values during job argument construction. This misconfiguration allows the attacker to schedule update or destroy triggers that target records belonging to other users, or even records residing in different tenants, effectively bypassing authorization controls. The flaw is a classic example of dynamic modification of object attributes, categorized under CWE‑915.

The vulnerability exists in the AshOban library from version 0.2.5 up to, but not including, 0.8.14. Only deployments employing AshOban within the Ash project are impacted.

The CVSS score of 5.9 places the issue in the medium range; however, because the weakness permits manipulation of job parameters that can execute data‑modifying actions, its impact can be significant if an attacker can supply arbitrary :args values. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be a user-centric interface that accepts job argument input, such as a web API endpoint or job builder front‑end, where the attacker supplies crafted :args to change target records.