Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-30233 OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with… https://www.cve.org/CVERecord?id=CVE-2026-30233
Post summary
The text discloses an authorization flaw in OliveTin that permits authenticated users to execute predefined shell commands, noting that it is fixed in version 3000.11.1.
CVE-2026-30233 OliveTin Authorization Bypass Vulnerability Allows Unauthorized Action Metadata Enumeration https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30233
Post summary
CVE-2026-30233 is an OliveTin authorization bypass that permits unauthorized metadata enumeration.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | olivetin | olivetin | - | - | - |