Medium severity · published Mar 6, 2026
CVE-2026-30233
OliveTin: View permission not being checked when returning dashboards
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OL
OliveTin · OliveTin
< 3000.11.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-30233
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-30233
Patch
https://github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0
Product
https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1
Exploit
https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pg
More from OliveTin
9.9
CVE-2026-27626
OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks
8.8
CVE-2026-30223
OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes
8.5
CVE-2026-31817
OliveTin's unsafe parsing of UniqueTrackingId can be used to write files
7.5
CVE-2026-67437
OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)
7.5
CVE-2026-48708
OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination