CVE-2026-78038: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes in ash-project ash_oban

The vulnerability in ash_oban occurs because AshOban.build_trigger/3 merges trusted job arguments with user-supplied :args. Trusted keys use atoms, while user keys arrive as strings due to JSON serialization, causing Map.merge to retain both keys without collision. When persisted, JSON de-duplication keeps the last string key, allowing user input to override trusted values. This enables an attacker to manipulate triggers to update or destroy records they should not access, including across tenants, violating authorization and tenant isolation. The issue affects ash_oban versions >=0.2.5 and <0.8.14.

An attacker who can influence the :args option in AshOban.build_trigger/3 can bypass authorization controls and tenant isolation by retargeting update or destroy triggers to other records, including those belonging to different tenants. This can lead to unauthorized data modification or deletion within the affected application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid forwarding untrusted user input directly into the :args option of AshOban.build_trigger/3. Review application code to ensure that user input cannot influence trusted job arguments that control record targeting.