CVE-2026-48709

LOW EPSS 24.6%
Published Jun 15, 20262w ago · Modified Jun 17, 20262w ago
3.7 CVSS 3.1
Low
Find Similar
Published Jun 15, 2026 2w ago
Last Modified Jun 17, 2026 2w ago

Description

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not call auth.UserFromApiCall or checkDashboardAccess. When AuthRequireGuestsToLogin is enabled (the security-conscious configuration), this endpoint remains accessible to unauthenticated users and can be used as an oracle to enumerate valid action binding IDs and their argument configurations. This issue has been fixed in version 3000.13.0.

CVSS Details

Base Score
3.7
Exploitability
2.2
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
24.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-862 Missing Authorization Authorization

References 2

  • github.com https://github.com/OliveTin/OliveTin/releases/tag/3000.13.0
  • github.com https://github.com/OliveTin/OliveTin/security/advisories/GHSA-f637-w7p2-m7fx

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.