CVE-2026-67439 in OliveTin
Summary
by MITRE • 07/30/2026
OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user with exec permission but logs:false to read action output. This issue is fixed in version 3000.17.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
The vulnerability resides within OliveTin's web-based shell command interface where unauthorized information disclosure occurs due to insufficient permission checks. This flaw affects versions prior to 3000.17.0 and specifically targets the service/internal/api/api.go file where two critical endpoints exist - StartActionAndWait and StartActionByGetAndWait. These endpoints are designed to execute predefined shell commands through a web interface but fail to properly validate user permissions before returning detailed execution output. The technical implementation flaw stems from the absence of proper access control enforcement when processing log entries, allowing malicious actors with exec permission but without explicit logs permission to bypass security controls and access sensitive command output data.
The operational impact of this vulnerability is significant as it enables privilege escalation through information disclosure rather than direct code execution. An attacker who has been granted execute permissions on specific actions but not logging permissions can exploit this flaw to obtain detailed output from executed commands, potentially revealing system information, configuration details, or sensitive data that would normally be restricted. This represents a clear violation of the principle of least privilege and demonstrates how improper permission enforcement can create security gaps even when users have limited access rights. The vulnerability specifically affects the logging functionality where the system returns full LogEntry output containing potentially confidential information about command execution results.
From a cybersecurity perspective, this issue aligns with CWE-284 (Improper Access Control) and represents a failure in implementing proper authorization checks within the application's API layer. The ATT&CK framework categorizes this as a privilege escalation technique through information disclosure, where adversaries leverage weak access controls to gain insights into system operations that should remain restricted. The flaw occurs at the application logic level where the system fails to enforce proper permission boundaries between execution capabilities and logging visibility. This vulnerability type is particularly concerning because it allows for reconnaissance activities without requiring additional attack vectors or exploiting other security weaknesses.
The mitigation strategy involves implementing proper permission validation before returning sensitive output data from the API endpoints. Version 3000.17.0 addresses this by enforcing the logs permission check within the StartActionAndWait and StartActionByGetAndWait functions, ensuring that users must have explicit logging permissions in addition to execution rights before access to full LogEntry output is granted. Organizations should verify their OliveTin installations are updated to 3000.17.0 or later and conduct thorough permission reviews to ensure proper access control policies are in place. Additionally, implementing network segmentation and monitoring for unauthorized access attempts to command execution interfaces can provide additional defense-in-depth measures against similar privilege escalation scenarios.