{"uuid": "7202750f-8639-472b-adb2-545325765359", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-67439", "type": "seen", "source": "https://gist.github.com/alon710/4da77a0fb37a106d6065c5dabb250f4c", "content": "# CVE-2026-67439: CVE-2026-67439: Incorrect Authorization Leading to Log Leak in OliveTin\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67439\n\n## Summary\nAn incorrect authorization vulnerability (CWE-863) exists in OliveTin prior to version 3000.17.0. The flaw allows authenticated users who are authorized to execute commands but restricted from viewing logs to bypass this restriction. By utilizing synchronous endpoints, attackers can directly access execution outputs containing sensitive system data, credentials, and environmental configurations.\n\n## TL;DR\nOliveTin failed to validate log-viewing permissions on synchronous execution endpoints, leaking sensitive shell outputs to restricted users.\n\n## Technical Details\n\n- **CWE ID**: CWE-863 (Incorrect Authorization)\n- **Attack Vector**: Network (AV:N)\n- **Privileges Required**: Low (PR:L)\n- **CVSS v3.1 Score**: 4.3 (Medium)\n- **EPSS Score**: 0.00252 (Percentile: 16.75%)\n- **Exploit Status**: None (No public PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- OliveTin Core Server\n- **OliveTin**: >= 3000.7.0, < 3000.17.0 (Fixed in: `3000.17.0`)\n\n## Mitigation\n\n- Restrict 'exec' permissions to only fully trusted administrators.\n- Audit command outputs to verify no sensitive data is written to standard output or standard error.\n- Monitor application log endpoints for anomalous synchronous API calls.\n\n**Remediation Steps:**\n1. Upgrade the OliveTin installation to version 3000.17.0 or higher.\n2. Validate the configurations in /etc/OliveTin/config.yaml for data exposure.\n3. Restart the OliveTin service to apply configuration and binary upgrades.\n\n## References\n\n- [GitHub Security Advisory GHSA-jm28-2wcr-qf3h](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-jm28-2wcr-qf3h)\n- [NVD CVE-2026-67439 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-67439)\n- [CVE.org CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-67439)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67439) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T09:31:22.270843Z"}