oban-bg vulnerabilities and threats

CVE-2026-48592 is a medium severity missing authorization vulnerability in the oban_web component of oban-bg version 2.12.0. The issue occurs because the save-job event handler in the Elixir.Oban.Web.Jobs.DetailComponent module does not perform authorization checks, unlike other handlers. This could allow users with limited privileges to perform actions they should not be authorized to do. No official patch or remediation guidance is currently available.

CVE-2026-48593 is a medium severity uncontrolled resource consumption vulnerability in the oban_web component of oban-bg version 2.12.0. It occurs due to unbounded expansion of cron expression ranges in the Elixir.Oban.Web.CronExpr modules. An attacker with permission to schedule cron jobs can submit a maliciously large range, which causes excessive memory allocation when a user with dashboard access views the cron job list.