5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30225

CVE-2026-30225: OliveTin: RestartAction always runs actions as guest

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new internal connect.Request without preserving the original caller’s authentication headers or cookies. When this synthetic request is passed to StartAction, the authentication resolver falls back to the guest user. If the guest account has broader permissions than the authenticated caller, this results in privilege escalation and unauthorized command execution. This vulnerability allows a low‑privileged authenticated user to bypass ACL restrictions and execute arbitrary configured shell actions. This issue has been patched in version 3000.11.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30225

CVE-2026-30225:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/OliveTin/OliveTin	go	< 0.0.0-20260305000458-cb46a597b246	0.0.0-20260305000458-cb46a597b246

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the RestartAction function, which is responsible for re-executing a previously run action. The core of the issue lies in how RestartAction constructs a new request to call the StartAction function. In the vulnerable version, it creates a new connect.Request object but fails to carry over the authentication details from the original user's request. When StartAction receives this new, unauthenticated request, its authentication logic (auth.UserFromApiCall) defaults to using the 'guest' user. If the guest user has been configured with permissions that the original, authenticated user lacks (e.g., permission to execute shell commands), this results in a privilege escalation. A low-privilege user can therefore exploit this to execute actions they are not authorized to run. The fixing patch confirms this by removing the call to StartAction and instead, correctly retrieving the authenticated user from the original request context and directly preparing and executing the action with the correct user's permissions.

Vulnerable functions

oliveTinAPI.RestartAction

service/internal/api/api.go

The `RestartAction` function creates a new `connect.Request` to call `StartAction` but fails to preserve the authentication context (headers or cookies) from the original request. This causes the subsequent authentication check in `StartAction` to fall back to the guest user, leading to a privilege escalation if the guest account has higher privileges than the authenticated user.

oliveTinAPI.StartAction

service/internal/api/api.go

This function is called by the vulnerable `RestartAction` with a request that lacks proper authentication. The `UserFromApiCall` function within `StartAction` then incorrectly defaults to the guest user, as the necessary authentication headers from the original caller are missing. This allows the action to be executed with the guest's permissions.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.