6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30233

CVE-2026-30233: OliveTin: View permission not being checked when returning dashboards

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30233

CVE-2026-30233:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/OliveTin/OliveTin	go	< 0.0.0-20260305082002-d7962710e7c4	0.0.0-20260305082002-d7962710e7c4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-jf73-858c-54pg, is an authorization flaw in OliveTin where the application does not enforce 'view' permissions when constructing API responses for dashboards and actions. Authenticated users with view: false permissions could still enumerate action metadata, such as titles, IDs, icons, and arguments, even though they were correctly denied execution rights.

The root cause is the absence of calls to the acl.IsAllowedView() function in several key code paths responsible for generating API responses. The analysis of the patch commit d7962710e7c4 confirms this.

(*oliveTinAPI).GetActionBinding: This API endpoint allowed a direct lookup of an action by its ID. The original code fetched the action and returned its details without any permission check. The patch adds an explicit check using api.userCanViewAction, which wraps acl.IsAllowedView.
buildDefaultDashboard: This function, which assembles the main dashboard, iterated through all actions and added them to the response. The patch introduces a call to acl.IsAllowedView inside the loop, ensuring that only permitted actions are included.
(*DashboardRenderRequest).findActionForEntity: This helper function, used for finding actions, also lacked a view permission check before returning action details. The patch adds the necessary acl.IsAllowedView check.

An attacker could exploit this by logging in as a low-privilege user and making API calls to the /api/GetDashboard or /api/GetActionBinding endpoints to discover potentially sensitive information about actions that should be hidden.

Vulnerable functions

(*oliveTinAPI).GetActionBinding

service/internal/api/api.go

This API endpoint handler fetched action details by ID and returned them without verifying if the user had 'view' permissions. The patch refactored this logic into a new function, `getActionBindingResponse`, which now includes a call to `api.userCanViewAction` to enforce the necessary authorization check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.