OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure.

Affected: Go: github.com/OliveTin/OliveTin

### Summary

OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure. I validated this on OliveTin 3000.10.2.

### Details The issue is in the live event streaming path.

EventStream() only checks whether the caller may access the dashboard, then registers the user as a stream subscriber:

- service/internal/api/api.go:776

After subscription, execution events are broadcast to all connected clients without checking whether each recipient is authorized to view logs for the action:

- service/internal/api/api.go:846 OnExecutionStarted - service/internal/api/api.go:869 OnExecutionFinished - service/internal/api/api.go:1047 OnOutputChunk

The event payload includes action output through:

- service/internal/api/api.go:295 internalLogEntryToPb - service/internal/api/api.go:302 Output

By contrast, the normal log APIs do apply per-action authorization checks:

- service/internal/api/api.go:518 GetLogs - service/internal/api/api.go:585 GetActionLogs - service/internal/api/api.go:544 isLogEntryAllowed

Root cause:

- the subscription path enforces only coarse dashboard access - execution callbacks broadcast to every connected client - no per-recipient ACL check is applied befo…