CVE-2026-30233

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata. This issue has been patched in version 3000.11.1.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 6, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-302346.5OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authenticated project member with BCF import permi CVE-2026-302356.5OpenProject is an open-source, web-based project management software. Prior to 17.2.0, this vulnerability occurs due to improper validation CVE-2026-302364.3OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when editing a project budget and planning the labor CVE-2026-302376.1Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is CVE-2026-302386.1Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is CVE-2026-302397.1OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were CVE-2026-30245.4Stored Cross-Site Scripting (XSS) vulnerability in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/configuracion/a CVE-2026-302408.1Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerabil CVE-2026-302418.2Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL s CVE-2026-302428.5Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py o CVE-2026-302447.5Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and ex CVE-2026-302466.5Fiber is a web framework for Go. In github.com/gofiber/fiber/v3 versions through 3.1.0, the default key generator in the cache middleware us