CVE-2026-48709

Katalog CVE

CVSS 3.7 · Low EPSS 0,42%

Kerentanan Missing Authorization. Skor CVSS 3.1 3.7 (Low) menurut github.com.

Deskripsi (NVD)

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not call auth.UserFromApiCall or checkDashboardAccess. When AuthRequireGuestsToLogin is enabled (the security-conscious configuration), this endpoint remains accessible to unauthenticated users and can be used as an oracle to enumerate valid action binding IDs and their argument configurations. This issue has been fixed in version 3000.13.0.

Rincian

Terbit di NVD

15 Juni 2026

Terakhir diubah

24 Juni 2026

Status NVD

Deferred

CVSS 3.1

3.7 (Low), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/OliveTin/OliveTin/commit/a3865704c854061452a4ab5f6d95de3312698ccd
• https://github.com/OliveTin/OliveTin/releases/tag/3000.13.0
• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-f637-w7p2-m7fx