OliveTin allows an unauthenticated guest to prematurely terminate any running action by invoking the KillAction RPC, even when guests are required to log in. This broken access control results in a denial‑of‑service against legitimate executions and can disrupt scheduled tasks or operational processes. The weakness aligns with CWE‑284, CWE‑862, and CWE‑863.

The flaw impacts OliveTin installations prior to version 3000.11.0. All affected deployments, regardless of the guests setting, are vulnerable until the patch is applied; version 3000.11.0 and later contain the fix.

The CVSS score of 7.5 indicates high severity, yet the EPSS score of less than 1 % suggests exploitation is currently unlikely. The attack requires network access to the OliveTin server and the ability to send a valid RPC request; guests are otherwise blocked from the GUI dashboard, so the weaponization path relies solely on the exposed KillAction endpoint. The vulnerability is not listed in CISA’s KEV catalog.