CVE-2026-48592

@@ -101,6 +101,7 @@ The available fine-grained actions are:
 | `:scale_queues`     | Change queue concurrency               |
 | `:stop_queues`      | Stop queues entirely                   |
 | `:update_crons`     | Edit cron configuration                |
+| `:update_jobs`      | Edit job fields like worker or args    |
 
 Actions not listed in the keyword list are considered disabled. For example, this configuration
 allows job management but prevents any queue operations:

@@ -503,7 +503,7 @@ defmodule Oban.Web.Jobs.DetailComponent do
         </button>
 
         <div id="edit-content" class={["mt-3", if(executing?(@job), do: "hidden")]}>
-          <fieldset disabled={executing?(@job)}>
+          <fieldset disabled={executing?(@job) or not can?(:update_jobs, @access)}>
             <form
               id="job-edit-form"
               class="grid grid-cols-4 gap-4 bg-gray-50 dark:bg-gray-800 rounded-md p-4"
@@ -571,7 +571,7 @@ defmodule Oban.Web.Jobs.DetailComponent do
                 </button>
                 <button
                   type="submit"
-                  disabled={not @edit_changed?}
+                  disabled={not @edit_changed? or not can?(:update_jobs, @access)}
                   class="px-6 py-2 bg-blue-500 text-white text-sm font-medium rounded-md hover:bg-blue-600 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-blue-500 focus-visible:ring-offset-2 cursor-pointer disabled:opacity-50 disabled:cursor-not-allowed"
                 >
                   Save Changes
@@ -813,14 +813,16 @@ defmodule Oban.Web.Jobs.DetailComponent do
   def handle_event("save-job", params, socket) do
     job = socket.assigns.job
 
-    changes =
-      params
-      |> parse_edit_params(job)
-      |> Enum.reject(fn {_key, val} -> is_nil(val) end)
-      |> Map.new()
+    if can?(:update_jobs, socket.assigns.access) do
+      changes =
+        params
+        |> parse_edit_params(job)
+        |> Enum.reject(fn {_key, val} -> is_nil(val) end)
+        |> Map.new()
 
-    if map_size(changes) > 0 do
-      send(self(), {:update_job, job, changes})
+      if map_size(changes) > 0 do
+        send(self(), {:update_job, job, changes})
+      end
     end
 
     {:noreply, assign(socket, edit_changed?: false)}

@@ -145,6 +145,7 @@ defmodule Oban.Web.Resolver do
           | :scale_queues
           | :stop_queues
           | :update_crons
+          | :update_jobs
 
   @type qualifier :: :args | :meta | :nodes | :queues | :tags | :workers
 
@@ -319,6 +320,7 @@ defmodule Oban.Web.Resolver do
   * `:scale_queues`
   * `:stop_queues`
   * `:update_crons`
+  * `:update_jobs`
 
   Actions which aren't listed are considered disabled.
 

@@ -115,6 +115,25 @@ defmodule Oban.Web.Pages.Jobs.DetailTest do
       assert render(live) =~ "Job updated successfully"
     end
 
+    test "read-only users cannot submit edits or rewrite the worker" do
+      job = insert_job!([ref: 1], state: "available", worker: WorkerA)
+
+      {:ok, live, _html} = live(build_conn(), "/oban-readonly")
+
+      open_state(live, "available")
+      open_details(live, job)
+
+      assert has_element?(live, "fieldset[disabled] #job-edit-form")
+
+      live
+      |> form("#job-edit-form", %{"worker" => "Attacker.Worker", "args" => "{}"})
+      |> render_submit()
+
+      reloaded = Repo.reload!(job)
+      assert reloaded.worker == job.worker
+      refute render(live) =~ "Job updated successfully"
+    end
+
     test "updating unrelated fields does not change scheduled_at", %{live: live} do
       scheduled_at = DateTime.utc_now() |> DateTime.add(3600) |> DateTime.truncate(:second)