medium4.3
CVE-2026-67439
OliveTin gives safe and simple access to predefined shell commands from a web interface.
Impact
OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user with exec permission but logs:false to read action output. This issue is fixed in version 3000.17.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/OliveTin/OliveTin | < 0.0.0-20260708085316-e421780c9885 | 0.0.0-20260708085316-e421780c9885 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-jm28-2wcr-qf3h
- https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jm28-2wcr-qf3h
- https://nvd.nist.gov/vuln/detail/CVE-2026-67439
- https://github.com/OliveTin/OliveTin/commit/e421780c9885aa5024d2f47b4ed4898f2f18eb90
- https://github.com/OliveTin/OliveTin/releases/tag/3000.17.0