OliveTin EUVD-2026-36906

Requires an authenticated account on the OliveTin web interface (PR:L) and at least two action executions happening concurrently - the normal operating mode whenever more than one user, or one user with parallel browser tabs, triggers actions. The race window is bounded by the time between tpl.Parse and t.Execute, so AC:H reflects that the attacker cannot deterministically force a win and must rely on scheduling or repeated attempts. No special non-default configuration, plugin, or platform is required: the shared package-level tpl variable is in the default code path of every affected version. Single-user deployments with no concurrent action invocations are not exploitable in practice.

The CVSS:3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.5 (High) and matches the threat model: an authenticated low-privileged web user, network-reachable, with high attack complexity because exploitation depends on goroutine scheduling. EPSS data is not provided and the CVE is not in CISA KEV, with no public exploit identified at time of analysis, so this is not a hair-on-fire priority. However, the race triggers under normal concurrent use rather than a contrived setup, so any multi-user OliveTin deployment is realistically affected - privilege boundaries between users of different action sets can collapse non-deterministically, which is more severe than the typical 'targeted race condition' framing. Operators running single-user instances behind trusted networks face limited real-world risk; operators using OliveTin as a shared command-runner for multiple roles should treat this as a priority patch.

Two authenticated OliveTin users - or one user triggering two actions in rapid succession - submit ExecRequests that race inside the shared template parser; the second Parse overwrites the first action's template tree just before Execute runs, causing user A's request to execute user B's parameterized shell command (or to panic the goroutine). An attacker with a low-privilege account could repeatedly invoke a benign action while a privileged user is known to be active, hoping to have their template tree adopted by the privileged user's Execute path and run an elevated command. No public exploit is identified at time of analysis, and exploitation is non-deterministic due to goroutine scheduling.