CVE-2026-28790 Details
Description
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.
A broken access control vulnerability has been identified in OliveTin versions prior to 3000.11.0. This issue allows unauthenticated guests to terminate running actions through the KillAction RPC, even when the authRequireGuestsToLogin setting is enabled. While guests are correctly blocked from accessing the dashboard, they can still invoke KillAction directly, disrupting active tasks. This vulnerability creates an unauthorized denial-of-service condition by allowing guests to interfere with legitimate action executions.
Users can upgrade to OliveTin version 3000.11.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OliveTin/OliveTin/security/advisories/GHSA-4fqm-6fmh-82mq | CISA-ADP | ExploitVendor Advisory |
| https://github.com/OliveTin/OliveTin/commit/d9804182eae43cf49f735e6533ddbe1541c2b9a9 | [email protected] | Patch |
| https://github.com/OliveTin/OliveTin/releases/tag/3000.11.0 | [email protected] | ProductRelease Notes |
| https://github.com/OliveTin/OliveTin/security/advisories/GHSA-4fqm-6fmh-82mq | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| olivetin olivetin | < 3000.11.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | CVE Modified | CISA-ADP |
| Mar 5, 2026 | New CVE Received | [email protected] |