Riskcovery

CVE-2026-30233

OliveTin: View permission not being checked when returning dashboards

State
Published
Severity
6.5 Medium
Published
Mar 6, 2026
Updated
Mar 9, 2026
Reserved
Mar 4, 2026

Read the record on cve.org

Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NGitHub_M

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-862 Missing Authorization

Affected Products

ProductVersions
OliveTinOliveTin
  • < 3000.11.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.