CVE-2026-48709: OliveTin Authentication Bypass Enables Command Enumeration

Technical summary

The ValidateArgumentType RPC endpoint in service/internal/api/api.go lacks authentication and authorization enforcement. While other data-returning API endpoints invoke auth.UserFromApiCall and checkDashboardAccess, this endpoint does neither. This creates an authentication bypass vulnerability in configurations where AuthRequireGuestsToLogin is enabled. Attackers can probe the endpoint to enumerate action binding IDs and their associated argument types, effectively using it as an oracle for reconnaissance. The vulnerability is classified as CWE-862 (Missing Authorization).

Business impact

The exposure is limited in scope: an attacker gains information disclosure about available commands and their structure, not execution capability. However, in environments where command inventory is considered sensitive or where command discovery accelerates further social engineering or targeted attacks against operations staff, this reconnaissance advantage carries moderate operational risk. The low CVSS score reflects that direct harm requires additional attack steps and that exposure depends on specific configuration choices.

Affected systems

OliveTin versions 3000.0.0 and earlier are affected. The vulnerability manifests only when AuthRequireGuestsToLogin is enabled—organizations running with guest login enabled or with no authentication requirement are already exposed to command visibility and are not uniquely impacted by this flaw. Version 3000.13.0 and later contain the fix.

Exploitability

Exploitability is straightforward from a technical standpoint: the endpoint is network-accessible and requires no credentials. However, practical exploitation requires knowledge of the endpoint's existence and structure, and the attacker gains only informational value, not command execution. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects low confidentiality impact, no integrity or availability impact, and a high attack complexity—likely because reconnaissance alone does not guarantee actionable harm.

Remediation

Upgrade OliveTin to version 3000.13.0 or later. If immediate patching is not possible, restrict network access to the OliveTin web interface using firewall rules or reverse-proxy authentication, or disable guest login if operationally feasible. Verify that auth.UserFromApiCall and checkDashboardAccess are invoked by all data-returning endpoints in your deployment.

Patch guidance

Apply the update to version 3000.13.0 or later. Consult the OliveTin release notes and vendor advisory to confirm the patch scope and any configuration changes required. Test the update in a non-production environment to ensure command execution and access controls function as expected before rolling out to production systems.

Detection guidance

Monitor HTTP logs for repeated requests to the ValidateArgumentType endpoint from unauthenticated clients or from unexpected source IPs. If your OliveTin instance is fronted by a reverse proxy or WAF, look for patterns of systematic argument-type queries that resemble enumeration activity. After patching, verify that the endpoint now returns authentication errors (401 or 403) when accessed without credentials and AuthRequireGuestsToLogin is enabled.

Why prioritize this

Although the CVSS score is low, prioritization depends on your threat model. If your OliveTin instance is exposed to untrusted networks and you rely on command secrecy for operational security, this flaw warrants prompt attention because it enables reconnaissance with zero barriers. Conversely, if OliveTin is used only internally and admin roles are well-known, the practical risk is reduced. The fix is available and straightforward; the blockers are typically organizational velocity, not technical complexity.

Risk score, explained

The CVSS 3.1 score of 3.7 (LOW) reflects low confidentiality impact (C:L), no integrity compromise (I:N), and no availability impact (A:N). The endpoint does not execute commands or modify data; it only discloses the structure and names of available commands to unauthenticated users. The high attack complexity (AC:H) likely reflects that the endpoint must be discovered and the response must be interpreted to yield meaningful intelligence. In defense-in-depth scenarios where command names are already public or where access controls prevent actual command execution by the attacker, the real-world risk may be even lower.

Frequently asked questions