CVE-2026-30233: OliveTin: View permission not being checked when returning dashboards
Vulnerability summary
CVE-2026-30233 is a medium (CVSS 6.5) vulnerability in olivetin. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 39.9% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 06-03-2026PublishedVulnerability first disclosed.
- 09-03-2026Last modifiedVulnerability information updated.
Description
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
Decrease -0.05 pp
From 0.51% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundOlivetin
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Github.com/OliveTin1 product
- OliveTin< 0.0.0-20260305082002-d7962710e7c4
Olivetin1 product
- olivetin< 3000.11.1
2 vendors · 2 products
References
5 links- github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pgX Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0X Refsource MISCWEBFIXPatch
- github.com/OliveTin/OliveTinPACKAGE