EUVD-2026-50565
GHSA-jm28-2wcr-qf3h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L reflects required exec-authenticated session; C:L bounded by log output scope; no integrity or availability impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user with exec permission but logs:false to read action output. This issue is fixed in version 3000.17.0.
AnalysisAI
Authorization bypass in OliveTin's synchronous action execution endpoints exposes full command log output to users holding exec permission but explicitly denied logs access. Versions prior to 3000.17.0 of this Go-based web shell interface are affected; the StartActionAndWait and StartActionByGetAndWait handlers return a complete LogEntry without invoking the isLogEntryAllowed ACL check that governs log visibility elsewhere in the application. No public exploit code exists and no CISA KEV listing is associated with this issue, placing real-world exploitation risk in context with the required authenticated access.
Technical ContextAI
OliveTin (CPE: cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:*) is a Go service that wraps predefined shell commands behind a gRPC-connect API, giving users a controlled interface to execute system commands from a browser. The vulnerable code in service/internal/api/api.go exposes two synchronous endpoints that execute an action and block until completion before returning a LogEntry proto. The pre-fix code path called startActionAndWaitRun followed directly by internalLogEntryToPb, skipping the requireLogEntryAllowed helper that is correctly applied on other log-returning paths. CWE-863 (Incorrect Authorization) is the root cause: the permission enforcement mechanism exists and works on other endpoints but was simply omitted from these two code paths, creating an authorization bypass rather than an absent authorization model.
RemediationAI
Upgrade OliveTin to version 3000.17.0, which introduces the logEntryForAllowedViewer helper that enforces requireLogEntryAllowed before returning any LogEntry from StartActionAndWait or StartActionByGetAndWait. The patched release is at https://github.com/OliveTin/OliveTin/releases/tag/3000.17.0 and the authoritative code change is at https://github.com/OliveTin/OliveTin/commit/e421780c9885aa5024d2f47b4ed4898f2f18eb90. As an interim workaround, remove the split-permission configuration by ensuring any user granted exec permission is also granted logs access, eliminating the exploitable mismatch; the trade-off is that it removes the intended ability to allow action execution without log visibility, which may conflict with the deployment's access control model.
OS command injection in OliveTin web shell interface through version 3000.10.0. OliveTin provides web-based access to pr
OliveTin gives access to predefined shell commands from a web interface. [CVSS 8.8 HIGH]
Arbitrary file write in OliveTin prior to 3000.11.2 allows authenticated attackers to write files to arbitrary filesyste
Memory-exhaustion denial of service in OliveTin (versions 3000.0.0 through 3000.16.x) allows a remote unauthenticated at
OliveTin versions prior to 3000.10.2 are vulnerable to unauthenticated denial of service through the PasswordHash API en
OliveTin versions prior to 3000.10.3 are vulnerable to unauthenticated denial-of-service attacks when OAuth2 authenticat
OliveTin versions prior to 3000.11.0 suffer from broken access control allowing unauthenticated users to invoke the Kill
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/a
OS command injection in OliveTin versions 3000.2.0 through 3000.16.x allows an authenticated user to execute arbitrary s
OliveTin prior to version 3000.11.1 fails to enforce view permission checks on dashboard and API endpoints, allowing aut
OliveTin prior to version 3000.11.1 fails to invalidate server-side sessions upon user logout, allowing attackers with a
OliveTin versions prior to 3000.11.1 contain an authentication bypass in RestartAction that allows authenticated users t
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today