https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 04:19:47 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275866 EUVD-2026-275866 https://cve.radiocsirt.org/vuln/euvd-2026-275866 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32102 <p>OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure.</p> <p>OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32102 https://cve.radiocsirt.org/vuln/ghsa-228v-wc5r-j8m7 <p><strong>Affected:</strong> Go: github.com/OliveTin/OliveTin</p> <p>### Summary</p> <p>OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure. I validated this on OliveTin 3000.10.2.</p> <p>### Details The issue is in the live event streaming path.</p> <p>EventStream() only checks whether the caller may access the dashboard, then registers the user as a stream subscriber:</p> <p>- service/internal/api/api.go:776</p> <p>After subscription, execution events are broadcast to all connected clients without checking whether each recipient is authorized to view logs for the action:</p> <p>- service/internal/api/api.go:846 OnExecutionStarted - service/internal/api/api.go:869 OnExecutionFinished - service/internal/api/api.go:1047 OnOutputChunk</p> <p>The event payload includes action output through:</p> <p>- service/internal/api/api.go:295 internalLogEntryToPb - service/internal/api/api.go:302 Output</p> <p>By contrast, the normal log APIs do apply per-action authorization checks:</p> <p>- service/internal/api/api.go:518 GetLogs - service/internal/api/api.go:585 GetActionLogs - service/internal/api/api.go:544 isLogEntryAllowed</p> <p>Root cause:</p> <p>- the subscription path enforces only coarse dashboard access - execution callbacks broadcast to every connected client - no per-recipient ACL check is applied befo…</p> <p><strong>Affected:</strong> Go: github.com/OliveTin/OliveTin</p> <p>### Summary</p> <p>OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure. I validated this on OliveTin 3000.10.2.</p> <p>### Details The issue is in the live event streaming path.</p> <p>EventStream() only checks whether the caller may access the dashboard, then registers the user as a stream subscriber:</p> <p>- service/internal/api/api.go:776</p> <p>After subscription, execution events are broadcast to all connected clients without checking whether each recipient is authorized to view logs for the action:</p> <p>- service/internal/api/api.go:846 OnExecutionStarted - service/internal/api/api.go:869 OnExecutionFinished - service/internal/api/api.go:1047 OnOutputChunk</p> <p>The event payload includes action output through:</p> <p>- service/internal/api/api.go:295 internalLogEntryToPb - service/internal/api/api.go:302 Output</p> <p>By contrast, the normal log APIs do apply per-action authorization checks:</p> <p>- service/internal/api/api.go:518 GetLogs - service/internal/api/api.go:585 GetActionLogs - service/internal/api/api.go:544 isLogEntryAllowed</p> <p>Root cause:</p> <p>- the subscription path enforces only coarse dashboard access - execution callbacks broadcast to every connected client - no per-recipient ACL check is applied befo…</p> https://cve.radiocsirt.org/vuln/ghsa-228v-wc5r-j8m7