Medium severity6.5NVD Advisory· Published Mar 6, 2026· Updated Jun 17, 2026
CVE-2026-30233
CVE-2026-30233
Description
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/OliveTin/OliveTinGo | < 0.0.0-20260305082002-d7962710e7c4 | 0.0.0-20260305082002-d7962710e7c4 |
Affected products
5- ghsa-coords3 versionspkg:golang/github.com/olivetin/olivetinpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6
< 0.0.0-20260305082002-d7962710e7c4+ 2 more
- (no CPE)range: < 0.0.0-20260305082002-d7962710e7c4
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
- (no CPE)range: < 0.0.20260317T205859-150000.1.152.1
Patches
Vulnerability mechanics
References
5- github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0nvdPatchWEB
- github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pgnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-jf73-858c-54pgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-30233ghsaADVISORY
- github.com/OliveTin/OliveTin/releases/tag/3000.11.1nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.