EUVD-2026-36907
GHSA-f637-w7p2-m7fx
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable endpoint requiring no attacker privileges, but AC:H because exploitation requires the non-default AuthRequireGuestsToLogin setting; confidentiality limited to action metadata only.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not call auth.UserFromApiCall or checkDashboardAccess. When AuthRequireGuestsToLogin is enabled (the security-conscious configuration), this endpoint remains accessible to unauthenticated users and can be used as an oracle to enumerate valid action binding IDs and their argument configurations. This issue has been fixed in version 3000.13.0.
AnalysisAI
OliveTin's ValidateArgumentType RPC endpoint exposes action binding IDs and argument configurations to unauthenticated network requesters in all versions prior to 3000.13.0, functioning as an enumeration oracle. The bypass is particularly counterintuitive because it manifests specifically when AuthRequireGuestsToLogin is enabled - the hardened security posture - meaning operators who consciously locked down their instance are the ones exposed. The confidentiality impact is limited to internal action metadata (no credentials, no command execution), and no public exploit has been identified at time of analysis.
Technical ContextAI
OliveTin is a Go-based web application (CPE: cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:*) that presents predefined shell commands through a browser UI and a gRPC/REST API surface. The flaw resides in service/internal/api/api.go at the ValidateArgumentType RPC handler, which omits the auth.UserFromApiCall and checkDashboardAccess calls present in every other data-returning endpoint. This constitutes a CWE-862 (Missing Authorization) defect - the code path exists and is reachable but was never gated. The endpoint's purpose is to validate argument types against action bindings, which means it necessarily returns valid binding IDs and their argument schemas as a side-effect of its normal function, making it a structural oracle even without any vulnerability-specific payload crafting.
RemediationAI
Upgrade OliveTin to version 3000.13.0, which resolves this issue via commit a3865704c854061452a4ab5f6d95de3312698ccd as documented in the release at https://github.com/OliveTin/OliveTin/releases/tag/3000.13.0. Container operators can pull the patched image using docker pull ghcr.io/olivetin/olivetin:3000.13.0 or docker pull docker.io/jamesread/olivetin:3000.13.0 with no breaking changes noted between the prior release and 3000.13.0. As a compensating control prior to patching, place OliveTin behind a network-layer access control - such as a reverse proxy (nginx, Caddy) enforcing IP allowlisting or HTTP basic authentication - to prevent unauthenticated clients from reaching the ValidateArgumentType endpoint entirely. Note that this network-level control does not remediate the application-layer missing authorization; it only reduces exposure, and should be treated as temporary until the upgrade is applied.
OS command injection in OliveTin web shell interface through version 3000.10.0. OliveTin provides web-based access to pr
OliveTin gives access to predefined shell commands from a web interface. [CVSS 8.8 HIGH]
Arbitrary file write in OliveTin prior to 3000.11.2 allows authenticated attackers to write files to arbitrary filesyste
Memory-exhaustion denial of service in OliveTin (versions 3000.0.0 through 3000.16.x) allows a remote unauthenticated at
OliveTin versions prior to 3000.10.2 are vulnerable to unauthenticated denial of service through the PasswordHash API en
OliveTin versions prior to 3000.10.3 are vulnerable to unauthenticated denial-of-service attacks when OAuth2 authenticat
OliveTin versions prior to 3000.11.0 suffer from broken access control allowing unauthenticated users to invoke the Kill
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/a
OS command injection in OliveTin versions 3000.2.0 through 3000.16.x allows an authenticated user to execute arbitrary s
OliveTin prior to version 3000.11.1 fails to enforce view permission checks on dashboard and API endpoints, allowing aut
OliveTin prior to version 3000.11.1 fails to invalidate server-side sessions upon user logout, allowing attackers with a
OliveTin versions prior to 3000.11.1 contain an authentication bypass in RestartAction that allows authenticated users t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today