CVE-2026-30233: OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated…

PriorityP426medium4.3CVSS 3.1

AVNACLPRLUINSUCLINAN

EPSS

0.42%

33.4th percentile

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
github.com	olivetin_olivetin	>= 0 < 0.0.0-20260305082002-d7962710e7c4	0.0.0-20260305082002-d7962710e7c4
olivetin	olivetin	< 3000.11.1	3000.11.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.