CVE-2026-28790

HIGH 7.5

OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.

CWE	CWE-284 CWE-862 CWE-863
Vendor	olivetin
Product	olivetin
Published	Mar 5, 2026
Last Updated	Mar 6, 2026

Stay Ahead of the Next One

Get instant alerts for olivetin olivetin

Be the first to know when new high vulnerabilities affecting olivetin olivetin are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

OliveTin / OliveTin

< 3000.11.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/OliveTin/OliveTin/security/advisories/GHSA-4fqm-6fmh-82mq github.com: https://github.com/OliveTin/OliveTin/commit/d9804182eae43cf49f735e6533ddbe1541c2b9a9 github.com: https://github.com/OliveTin/OliveTin/releases/tag/3000.11.0