VDB
CVE-2026-32102
CVE-2026-32102
PUBLISHED
CVSS 7.099999904632568 HIGH
OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure.
EPSS 0.02% · 7.1th percentile
Risk Scores
CVSS v4.0
7.099999904632568
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.02%
7.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| OliveTin | OliveTin | < 3000.10.2, < 3000.10.2, < 3000.10.2 |
| github.com | OliveTin/OliveTin | 0, 0, 0 |
| olivetin | olivetin | 0, 0, 0 |
Timeline
- Mar 11, 2026 CVE Published
- Mar 12, 2026 EPSS Score
- Mar 12, 2026 CVE Updated
- Mar 13, 2026 EPSS Score
- Mar 14, 2026 EPSS Score
- Mar 15, 2026 EPSS Score
- Mar 16, 2026 EPSS Score
- Mar 17, 2026 EPSS Score
- Mar 17, 2026 Coalition ESS Score
- Mar 17, 2026 Security Advisory
- Mar 18, 2026 EPSS Score
- Mar 19, 2026 EPSS Score