VulnerabilityAnalyzed

CVE-2026-30233

Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints.

MEDIUM 4.3EPSS 0.42%

Does this matter?

Lower severity and a low EPSS score (0.42%). Track it; it rarely justifies an emergency change on its own.

Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.42% probability · 35th percentile
CISA KEV: Not listed
Weakness: CWE-200, CWE-862
Affected: olivetin/olivetin
Source: security-advisories@github.com

References

https://github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0Patch
https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1Product, Release Notes
https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pgExploit, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.