OliveTin: RestartAction always runs actions as guest
Description
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new internal connect.Request without preserving the original caller’s authentication headers or cookies. When this synthetic request is passed to StartAction, the authentication resolver falls back to the guest user. If the guest account has broader permissions than the authenticated caller, this results in privilege escalation and unauthorized command execution. This vulnerability allows a low‑privileged authenticated user to bypass ACL restrictions and execute arbitrary configured shell actions. This issue has been patched in version 3000.11.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
OliveTin prior to 3000.11.1 contains an authentication context confusion in RestartAction that allows a low-privileged user to impersonate the guest account and bypass ACLs.
Vulnerability
OliveTin's RestartAction constructs a new internal connect.Request when restarting a previously executed action, but fails to copy the original caller's authentication headers or cookies [1][2]. When this synthetic request is passed to StartAction, the authentication resolver auth.UserFromApiCall() cannot find any credentials, so it falls back to the guest user [2]. This authentication context confusion means that the action is executed under the guest identity instead of the original user's identity.
Exploitation
The vulnerability can be exploited by a low-privileged authenticated user whose permissions have exec: false, while the guest account has exec: true [2]. The attacker triggers the RestartAction endpoint for any previously executed action. Because the guest account has broader permissions, the action — even one the attacker is normally forbidden to run — executes with the guest's privileges [2]. No special network position is required beyond normal authenticated access to the web interface.
Impact
A low-privileged authenticated user can bypass Access Control List (ACL) restrictions and execute arbitrary configured shell actions as if they were the guest user [1][2]. If the guest account has permissions to run any action, this effectively allows privilege escalation to the highest level available in the configuration. The impact is high in environments where guest permissions exceed those of some regular users.
Mitigation
The vulnerability is fixed in OliveTin version 3000.11.1 [1][2][4]. The patch modifies RestartAction to extract the authenticated user from the original request context and pass it explicitly to the executor, rather than constructing a new request without authentication information [4]. Users should upgrade immediately; there is no workaround if guest accounts are used with elevated permissions.
AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/OliveTin/OliveTinGo | < 0.0.0-20260305000458-cb46a597b246 | 0.0.0-20260305000458-cb46a597b246 |
Affected products
2- OliveTin/OliveTinv5Range: < 3000.11.1
Patches
1cb46a597b246security: GHSA-p443-p7w5-2f7f (MODERATE) RestartAction always runs actions as guest
1 file changed · +15 −8
service/internal/api/api.go+15 −8 modified@@ -1271,8 +1271,6 @@ func (api *oliveTinAPI) RestartAction(ctx ctx.Context, req *connect.Request[apiv ExecutionTrackingId: req.Msg.ExecutionTrackingId, } - var execReqLogEntry *executor.InternalLogEntry - execReqLogEntry, found := api.executor.GetLog(req.Msg.ExecutionTrackingId) if !found { @@ -1289,12 +1287,21 @@ func (api *oliveTinAPI) RestartAction(ctx ctx.Context, req *connect.Request[apiv return connect.NewResponse(ret), nil } - return api.StartAction(ctx, &connect.Request[apiv1.StartActionRequest]{ - Msg: &apiv1.StartActionRequest{ - BindingId: execReqLogEntry.GetBindingId(), - UniqueTrackingId: req.Msg.ExecutionTrackingId, - }, - }) + authenticatedUser := auth.UserFromApiCall(ctx, req, api.cfg) + + // TrackingID is deliberately not passed to the executor, so that it generates a new one for the restarted execution. + // This is because the old execution (identified by the old TrackingID) is already used. + execReq := executor.ExecutionRequest{ + Binding: execReqLogEntry.Binding, + Arguments: make(map[string]string), + AuthenticatedUser: authenticatedUser, + Cfg: api.cfg, + } + + api.executor.ExecRequest(&execReq) + + ret.ExecutionTrackingId = execReq.TrackingID + return connect.NewResponse(ret), nil } func newServer(ex *executor.Executor) *oliveTinAPI {
Vulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/advisories/GHSA-p443-p7w5-2f7fghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-30225ghsaADVISORY
- github.com/OliveTin/OliveTin/commit/cb46a597b2465235839ed58cf034b5e7b70ef911ghsax_refsource_MISCWEB
- github.com/OliveTin/OliveTin/releases/tag/3000.11.1ghsax_refsource_MISCWEB
- github.com/OliveTin/OliveTin/security/advisories/GHSA-p443-p7w5-2f7fghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.