3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48709

CVE-2026-48709: OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not call auth.UserFromApiCall or checkDashboardAccess. When AuthRequireGuestsToLogin is enabled (the security-conscious configuration), this endpoint remains accessible to unauthenticated users and can be used as an oracle to enumerate valid action binding IDs and their argument configurations. This issue has been fixed in version 3000.13.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48709

CVE-2026-48709:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/OliveTin/OliveTin	go	< 0.0.0-20260521230847-a3865704c854	0.0.0-20260521230847-a3865704c854

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the ValidateArgumentType function within service/internal/api/api.go. The function, prior to the patch, did not perform any authentication or authorization checks. This allowed an unauthenticated attacker to call this endpoint and, by observing the responses, enumerate valid action binding IDs and their corresponding argument configurations. This is especially problematic when the AuthRequireGuestsToLogin setting is enabled, as it's intended to restrict access to guests.

The patch addresses this by adding authentication and authorization checks at the beginning of the ValidateArgumentType function, specifically by calling auth.UserFromApiCall and api.checkDashboardAccess. Additionally, a new function, validateArgumentTypeBindingAccess, was introduced to verify that the user has the necessary permissions to view the action associated with the binding ID. These changes ensure that only authenticated and authorized users can use the ValidateArgumentType endpoint, thus mitigating the information disclosure vulnerability.

Vulnerable functions

oliveTinAPI.ValidateArgumentType

service/internal/api/api.go

The `ValidateArgumentType` function was missing authentication and authorization checks, allowing unauthenticated users to enumerate action and argument details when `AuthRequireGuestsToLogin` was enabled. The patch added checks to ensure only authorized users can access this endpoint's information.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.