OliveTin’s EventStream feature broadcasts execution events and action output to all authenticated dashboard subscribers without enforcing per-action authorization. This flaw allows a low‑privileged authenticated user to receive the output of commands they are not permitted to view, leading to sensitive information disclosure. The weakness corresponds to CWE‑284 (Improper Authorization) and CWE‑863 (Missing Authorization for a Mechanism).

The vulnerability affects OliveTin 3000.10.2 and earlier. All deployments of OliveTin that use the default EventStream setting and have multiple authenticated users are potentially impacted. The CNA identifies OliveTin:OliveTin as the affected vendor/product.

The CVSS score is 7.1, indicating a high severity. The EPSS score is below 1%, suggesting a low probability of exploitation in the near term, and the vulnerability is not listed in CISA’s KEV catalog. However, because the exploit requires only normal authentication to the dashboard, an attacker who gains such credentials can easily obtain unauthorized command output. The overall risk is moderate-high for environments with sensitive data handled by OliveTin commands.