CVE-2026-32102

OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/OliveTin/OliveTin/security/advisories/GHSA-228v-wc5r-j8m7	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:*

History

17 Mar 2026, 15:34

Type	Values Removed	Values Added
CPE		cpe:2.3:a:olivetin:olivetin::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 6.5
Summary		(es) OliveTin da acceso a comandos de shell predefinidos desde una interfaz web. En 3000.10.2 y anteriores, el EventStream en vivo de OliveTin transmite eventos de ejecución y la salida de acciones a suscriptores autenticados del panel de control sin aplicar autorización por acción. Un usuario autenticado con bajos privilegios puede recibir la salida de acciones que no tiene permitido ver, lo que resulta en un control de acceso roto y revelación de información sensible.
First Time		Olivetin olivetin Olivetin
References	~~() https://github.com/OliveTin/OliveTin/security/advisories/GHSA-228v-wc5r-j8m7 -~~	() https://github.com/OliveTin/OliveTin/security/advisories/GHSA-228v-wc5r-j8m7 - Exploit, Vendor Advisory

11 Mar 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-11 21:16

Updated : 2026-03-17 15:34

NVD link : CVE-2026-32102

Mitre link : CVE-2026-32102

CVE.ORG link : CVE-2026-32102

JSON object : View

Products Affected

olivetin

olivetin

CWE

CWE-284

Improper Access Control

CWE-863

Incorrect Authorization

{"id": "CVE-2026-32102", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-03-11T21:16:16.167", "references": [{"url": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-228v-wc5r-j8m7", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin\u2019s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure."}, {"lang": "es", "value": "OliveTin da acceso a comandos de shell predefinidos desde una interfaz web. En 3000.10.2 y anteriores, el EventStream en vivo de OliveTin transmite eventos de ejecuci\u00f3n y la salida de acciones a suscriptores autenticados del panel de control sin aplicar autorizaci\u00f3n por acci\u00f3n. Un usuario autenticado con bajos privilegios puede recibir la salida de acciones que no tiene permitido ver, lo que resulta en un control de acceso roto y revelaci\u00f3n de informaci\u00f3n sensible."}], "lastModified": "2026-03-17T15:34:48.810", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B4582D9-169E-40D5-8E85-A2C591F413A9", "versionEndIncluding": "3000.10.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}