OliveTin CVE-2026-67439

Exploitation requires a valid authenticated OliveTin session with exec permission granted for at least one configured action. The vulnerable condition arises only when an administrator has explicitly configured a split permission where exec is true and logs is false for that user or role - a deliberate but legitimate access-control configuration. Users with both exec and logs permissions, or users with neither, are not affected. No special network position beyond HTTP/HTTPS access to the OliveTin instance is required. What limits exploitation: the attacker must have a valid account, must have been granted exec permission by an administrator, and the deployment must use the split-permission model; fully open or fully restricted accounts are unaffected.

The official CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is well-calibrated; the security advisory's own CVSS note confirms 4.3-5.3 as the expected range, consistent with authenticated information disclosure. No EPSS data was supplied in the input, so exploitation probability cannot be quantified. The absence of a CISA KEV listing and no reported public exploit code keep this at a moderate remediation priority. Real-world severity depends heavily on what OliveTin actions are configured to execute and what their output contains - environments where action output includes credentials, internal hostnames, query results, or secrets would face elevated data-exposure risk. The mandatory exec permission already implies a degree of organizational trust in the user, narrowing the plausible attacker population. This is a real, patchable flaw but not a fire-drill priority absent sensitive log content.

An authenticated OliveTin user who holds exec permission for a configured action but has been denied logs access calls the StartActionAndWait API endpoint. The server executes the action, waits for completion, and returns the full LogEntry including all captured standard output and error without checking the logs ACL. If the action output includes sensitive material such as database query results, API tokens printed by a script, or internal network details, the attacker reads this data without authorization.