A configuration flaw in OliveTin’s API allowed users with only execution rights but no logging rights to retrieve the full logs of a command, effectively bypassing the logs permission. The flaw does not grant arbitrary code execution, but it permits the exposure of potentially sensitive command output that might contain system information or secrets. The weakness mapped to CWE‑863 highlights an authorization bypass through user‑controlled keys.

OliveTin’s OliveTin service is affected. All deployments running a version earlier than 3000.17.0 are vulnerable. The vulnerability originates in the StartActionAndWait and StartActionByGetAndWait endpoints, so any instance exposing these endpoints is at risk.

The CVSS score of 4.3 reflects a low‑medium severity. EPSS indicates the likelihood of exploitation is below 1 %, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote user accessing the web API and invoking the exposed StartActionAndWait or StartActionByGetAndWait endpoints; no local privilege escalation is required. An attacker would need authentication that grants exec rights but is denied logs rights to realize the data‑exposure benefit.