CVE-2026-28790

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.

• CWE-284
• CWE-862
• CWE-863
• CWE-862

• https://github.com/OliveTin/OliveTin/commit/d9804182eae43cf49f735e6533ddbe1541c2b9a9Patch
• https://github.com/OliveTin/OliveTin/releases/tag/3000.11.0Product, Release Notes
• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-4fqm-6fmh-82mqExploit, Vendor Advisory
• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-4fqm-6fmh-82mqExploit, Vendor Advisory

Published

Mar 5, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-28785Ghostfolio is an open source wealth management software. Pri…9.8
• CVE-2026-28786Open WebUI is a self-hosted artificial intelligence platform…4.3
• CVE-2026-28787OneUptime is a solution for monitoring and managing online s…9
• CVE-2026-28788Open WebUI is a self-hosted artificial intelligence platform…7.1
• CVE-2026-28789OliveTin gives access to predefined shell commands from a we…7.5
• CVE-2026-2879The GetGenie plugin for WordPress is vulnerable to Insecure …5.4
• CVE-2026-28791Tina is a headless content management system. Prior to 2.1.7…7.4
• CVE-2026-28792Tina is a headless content management system. Prior to 2.1.8…9.6
• CVE-2026-28793Tina is a headless content management system. Prior to 2.1.8…8.4
• CVE-2026-28794oRPC is an tool that helps build APIs that are end-to-end ty…9.8
• CVE-2026-28795OpenChatBI is an intelligent chat-based BI tool powered by l…9.8
• CVE-2026-28797RAGFlow is an open-source RAG (Retrieval-Augmented Generatio…8.8