OliveTin exposes predefined shell commands through a web interface, but an authorization flaw allows authenticated users who have the view permission disabled to still request dashboard and API endpoints that return action metadata such as titles, identifiers, icons, and argument details. The flaw does not grant execution rights, yet the leaked information provides insight into available commands and input requirements, potentially aiding attackers in crafting targeted exploits. This issue falls under the CWE-200 and CWE-862 categories, representing an information disclosure and missing access control vulnerability.

All installations of OliveTin prior to 3000.11.1 are affected, regardless of vendor or deployment environment. The flaw is present in the OliveTin:OliveTin product as documented in the official disclosure, and the patch was released with version 3000.11.1.

The CVSS base score of 6.5 indicates moderate severity, while an EPSS score of less than 1% shows a very low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Attackers would need authenticated access to the web interface and would exploit the missing view permission check to enumerate action bindings; the exploitation path is straightforward and does not require additional privileges beyond an existing authenticated session.