EUVD-2026-275134

fkie_cve-2026-30233

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.

GHSA-jf73-858c-54pg — OliveTin doesn't check view permission when returning dashboards

Affected: Go: github.com/OliveTin/OliveTin

### Summary An authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints.

Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata.

### Details OliveTin defines a view permission in its ACL model (acl.go). However, this permission is not consistently enforced when building dashboard and action metadata responses.

Relevant source locations:

dashboards.go (around line 120, 132) apiActions.go (around line 122) acl.go (around line 125) api.go (around line 430)

Dashboard building logic: ``` for _, binding := range rr.ex.MapActionBindings { if binding.Action.Hidden { continue } action := buildAction(binding, rr) // checks IsAllowedExec only fieldset.Contents = append(fieldset.Contents, ...) } ``` Why vulnerable: IsAllowedView() exists but is not enforced when building dashboard/action metadata. Users with view:false still receive action titles/icons/argument metadata (with canExec:false).

### PoC

1. Configure OliveTin with a restricted user:

Create config.yaml:

```yaml authRequireGuestsToLogin: true

authLocalUsers: enabled: true users: - username: admin password: "$argon2id$v=19$m=65536,t=4,p=2$puyxA0s555TSFx7hnFLCXA$PyhLGpZtvpMMvc2DgMWkM8OJMKO55euwV5gm//1i…

Most recent entries from all

EUVD-2026-275134

fkie_cve-2026-30233

GHSA-jf73-858c-54pg — OliveTin doesn't check view permission when returning dashboards