Vulnerability · Published Jul 29, 2026 · Assigned by GitHub_M
CVE-2026-67439OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output
Medium 4.3
In plain English
A medium-severity incorrect authorization in OliveTin from OliveTin. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user with exec permission but logs:false to read action output. This issue is fixed in version 3000.17.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/OliveTin/OliveTin | 0.0.0-20260708085316-e421780c9885 | GHSA-jm28-2wcr-qf3h |
| Go | github.com/OliveTin/OliveTin | 0.0.0-20260708085316-e421780c9885 | GO-2026-6144 |
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N