GitHub Security Advisory: GHSA-228v-wc5r-j8m7
Package: github.com/OliveTin/OliveTin (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-284: Improper Access Control, CWE-863: Incorrect Authorization
Vulnerable versions: < 3000.10.2
Patched in: 3000.10.2

Summary: OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream

Details:
### Summary

  OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are
  not allowed to view, resulting in broken access control and sensitive information disclosure. I validated this on OliveTin 3000.10.2.




### Details
The issue is in the live event streaming path.

  EventStream() only checks whether the caller may access the dashboard, then registers the user as a stream subscriber:

  - service/internal/api/api.go:776

  After subscription, execution events are broadcast to all connected clients without checking whether each recipient is authorized to view logs for the action:

  - service/internal/api/api.go:846 OnExecutionStarted
  - service/internal/api/api.go:869 OnExecutionFinished
  - service/internal/api/api.go:1047 OnOutputChunk

  The event payload includes action output through:

  - service/internal/api/api.go:295 internalLogEntryToPb
  - service/internal/api/api.go:302 Output

  By contrast, the normal log APIs do apply per-action authorization checks:

  - service/internal/api/api.go:518 GetLogs
  - service/internal/api/api.go:585 GetActionLogs
  - service/internal/api/api.go:544 isLogEntryAllowed

  Root cause:

  - the subscription path enforces only coarse dashboard access
  - execution callbacks broadcast to every connected client
  - no per-recipient ACL check is applied before sending action metadata or output

  I validated the issue using:

  - an admin user with full ACLs
  - an alice user with no ACLs
  - a protected action that outputs TOPSECRET=alpha-bravo-charlie

  Despite having no relevant ACLs, alice still receives the ExecutionFinished event for the privileged action, including the protected output.



### PoC
Tested version:
```
  - 3000.10.2
```
  1. Fetch and check out 3000.10.2 in a clean worktree:
```bash
  git -C OliveTin fetch origin tag 3000.10.2
  git -C OliveTin worktree add /home/kali/CVE/OliveTin-3000.10.2 3000.10.2
```
  2. Copy the PoC test into the clean tree:
```bash
  cp OliveTin/service/internal/api/event_stream_leak_test.go \
    OliveTin-3000.10.2/service/internal/api/
```
  3. Run the targeted PoC test:
```bash
  cd OliveTin-3000.10.2/service
  go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v
```
  4. Optional: save validation output:
```bash
  go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v \
    2>&1 | tee /tmp/olivetin_eventstream_3000.10.2.log
```
  Observed validation output:
```bash
  === RUN   TestEventStreamLeaksUnauthorizedExecutionOutput
  time="2026-03-01T04:44:59-05:00" level=info msg="Action requested" actionTitle=secret-action tags="[]"
  time="2026-03-01T04:44:59-05:00" level=info msg="Action parse args - Before" actionTitle=secret-action cmd="echo 'TOPSECRET=alpha-bravo-charlie'"
  time="2026-03