EUVD-2026-342685

fkie_cve-2026-67439

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user with exec permission but logs:false to read action output. This issue is fixed in version 3000.17.0.

GHSA-jm28-2wcr-qf3h — OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

Affected: Go: github.com/OliveTin/OliveTin

## Summary

The synchronous execution RPCs `StartActionAndWait` and `StartActionByGetAndWait` return the full `LogEntry` for the just-executed action without checking whether the caller is allowed to read that action's logs.

OliveTin's ACL model separates `exec` from `logs`. A deployment can intentionally allow a user to run an action while denying access to its historical or live output. That separation is enforced in `GetLogs`, `GetActionLogs`, `ExecutionStatus`, and `EventStream`, but it is not enforced in the synchronous `...AndWait` endpoints.

As a result, any user who can execute an action through these endpoints can read the action output immediately even when the action's ACL explicitly sets `logs:false`.

## Details

OliveTin defines separate per-action permissions:

```go // service/internal/config/config.go type PermissionsList struct { View bool `koanf:"view"` Exec bool `koanf:"exec"` Logs bool `koanf:"logs"` Kill bool `koanf:"kill"` } ```

The normal log and streaming paths correctly enforce `logs` permission:

```go // service/internal/api/api.go func (api *oliveTinAPI) isLogEntryAllowed(e *executor.InternalLogEntry, user *authpublic.AuthenticatedUser) bool { if user == nil || !isValidLogEntry(e) { return false } return acl.IsAllowedLogs(api.cfg, user, e.Binding.Action) } ```

That check is used by:

- `GetLogs` - `GetActionLogs` - `ExecutionStatus` - `EventStream`

However, the synchronous execution endpoints directly retu…

Most recent entries from all

EUVD-2026-342685

fkie_cve-2026-67439

GHSA-jm28-2wcr-qf3h — OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output