PT-2026-23617 · Olivetin · Olivetin

Zwique · Published 2026-03-05 · Updated 2026-03-25 · CVE-2026-30233

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OliveTin versions prior to 3000.11.1

Description OliveTin has an authorization issue where authenticated users with insufficient permissions (view: false) can access metadata related to actions through the dashboard and API endpoints. Specifically, the backend does not properly enforce view permissions when generating responses for dashboard and action binding information. This allows restricted users to retrieve details like action titles, IDs, icons, and argument metadata, even though they are not authorized to execute those actions. The vulnerable API endpoints include '/api/GetDashboard' and '/api/GetActionBinding'. The vulnerable parameter is bindingId in the '/api/GetActionBinding' endpoint. The issue stems from a failure to enforce the IsAllowedView() function when constructing these responses.

Recommendations Update OliveTin to version 3000.11.1 or later.

Exploit

Fix

Information Disclosure

Missing Authorization

Weakness Enumeration

CWE-200

CWE-862

Related Identifiers

CVE-2026-30233

GHSA-JF73-858C-54PG

GO-2026-4629

SUSE-SU-2026:1042-1

Affected Products

Olivetin

References · 140

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30233.json · Exploit
• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pg · Vendor Advisory
• https://github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30233 · Security Note
• https://osv.dev/vulnerability/GO-2026-4629 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30233 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jf73-858c-54pg · Vendor Advisory
• https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1 · Note
• https://github.com/OliveTin/OliveTin · Note
• https://suse.com/security/cve/CVE-2026-29194 · Note
• https://suse.com/security/cve/CVE-2026-28513 · Note
• https://suse.com/security/cve/CVE-2026-30852 · Note
• https://suse.com/security/cve/CVE-2026-28280 · Note
• https://suse.com/security/cve/CVE-2026-27116 · Note