OliveTin Unauthorized Action Output Disclosure via EventStream

Vulnerability

Overview

OliveTin is a web interface that provides safe access to predefined shell commands. In OliveTin 3000.10.2 and earlier, the live EventStream endpoint broadcasts execution events and action output to all authenticated dashboard subscribers without enforcing per-action authorization [1][2]. The root cause is that the subscription path (EventStream()) only checks coarse dashboard access, while execution callbacks broadcast to every connected client without a per-recipient ACL check [2].

Exploitation

An attacker with a low-privileged authenticated session can subscribe to the EventStream and receive execution events for actions they are not authorized to view. The advisory [2] includes a proof of concept where a user named 'alice' with no ACLs still receives the ExecutionFinished event for a privileged action, including protected output such as TOPSECRET=alpha-bravo-charlie [2]. The vulnerability is present in the OnExecutionStarted, OnExecutionFinished, and OnOutputChunk callbacks, which broadcast to all connected clients without checking per-action authorization [2].

Impact

Successful exploitation results in broken access control and sensitive information disclosure [1][2]. An authenticated low-privileged user can view the output of actions they are not permitted to access, potentially exposing confidential data or system details [2].

Mitigation

As of the advisory publication date (2026-03-11), the vendor has not released a patched version [2]. Users are advised to restrict access to the OliveTin dashboard to trusted users only and monitor for updates [2][3]. The vulnerability affects all versions up to and including 3000.10.2 [1][2].