https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 06:20:40 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-274830 EUVD-2026-274830 https://cve.radiocsirt.org/vuln/euvd-2026-274830 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28790 <p>OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.</p> <p>OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-28790 https://cve.radiocsirt.org/vuln/ghsa-4fqm-6fmh-82mq <p><strong>Affected:</strong> Go: github.com/OliveTin/OliveTin</p> <p>### Summary</p> <p>OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. In the tested release (3000.10.2), guests are correctly blocked from dashboard access, but an still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions.</p> <p>### Details The issue is caused by inconsistent authorization enforcement between dashboard access and action-control RPCs.</p> <p>KillAction() authenticates the caller and applies only the per-action kill ACL check:</p> <p>- service/internal/api/api.go:62</p> <p>However, it does not enforce the guest login requirement. The guest/login gate exists separately in:</p> <p>- service/internal/api/api.go:474</p> <p>That gate is used by dashboard-style methods, but not by KillAction.</p> <p>In addition, when authRequireGuestsToLogin is enabled, config sanitization disables guest view, exec, and logs permissions, but leaves kill unchanged:</p> <p>- service/internal/config/sanitize.go:160</p> <p>Specifically:</p> <p>- DefaultPermissions.View = false - DefaultPermissions.Exec = false - DefaultPermissions.Logs = false - DefaultPermissions.Kill remains unchanged</p> <p>As a result, in the default configuration path where Kill remains allowed, an unauthenticated guest user can still satisfy IsAllowedKill():</p> <p>- service/internal/acl/acl.go:133</p> <p>I validated this behavior on a c…</p> <p><strong>Affected:</strong> Go: github.com/OliveTin/OliveTin</p> <p>### Summary</p> <p>OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. In the tested release (3000.10.2), guests are correctly blocked from dashboard access, but an still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions.</p> <p>### Details The issue is caused by inconsistent authorization enforcement between dashboard access and action-control RPCs.</p> <p>KillAction() authenticates the caller and applies only the per-action kill ACL check:</p> <p>- service/internal/api/api.go:62</p> <p>However, it does not enforce the guest login requirement. The guest/login gate exists separately in:</p> <p>- service/internal/api/api.go:474</p> <p>That gate is used by dashboard-style methods, but not by KillAction.</p> <p>In addition, when authRequireGuestsToLogin is enabled, config sanitization disables guest view, exec, and logs permissions, but leaves kill unchanged:</p> <p>- service/internal/config/sanitize.go:160</p> <p>Specifically:</p> <p>- DefaultPermissions.View = false - DefaultPermissions.Exec = false - DefaultPermissions.Logs = false - DefaultPermissions.Kill remains unchanged</p> <p>As a result, in the default configuration path where Kill remains allowed, an unauthenticated guest user can still satisfy IsAllowedKill():</p> <p>- service/internal/acl/acl.go:133</p> <p>I validated this behavior on a c…</p> https://cve.radiocsirt.org/vuln/ghsa-4fqm-6fmh-82mq