OliveTin’s RestartAction feature incorrectly builds a synthetic request that loses the original authenticated user’s headers and cookies. When this request is supplied to StartAction, the authentication resolver defaults to the guest account. If the guest has broader permissions than the requesting user, the attacker can bypass ACL restrictions and execute hardened shell commands via the web interface. This flaw enables a low‑privileged but authenticated user to run arbitrary configured actions that they are normally forbidden from performing.

OliveTin OliveTin is the affected product. Any installation older than version 3000.11.1 is vulnerable. The update to version 3000.11.1 includes the fix; earlier releases remain at risk.

The CVSS score is 5.3, indicating moderate severity. The EPSS score of less than 1% signifies low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers must first authenticate to the OliveTin web interface and then invoke a RestartAction for an action they lack rights to. Because the synthetic request is treated as a guest session, the attacker enjoys elevated privileges defined for the guest account. No advanced prerequisites beyond a legitimate user login or remote access to the web interface are required.