OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login
Date: 2026-03
Affected: go/github.com/OliveTin/OliveTin
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-28790
CWE: CWE-284
CWE-862
CWE-863
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

### Summary OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. In the tested release (3000.10.2), guests are correctly blocked from dashboard access, but an still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. ### Details The issue is caused by inconsistent authorization enforcement between dashboard access and action-control RPCs. KillAction() authenticates the caller and applies only the per-action kill ACL check: - service/internal/api/api.go:62 However, it does not enforce the guest login requirement. The guest/login gate exists separately in: - service/internal/api/api.go:474 That gate is used by dashboard-style methods, but not by KillAction. In addition, when authRequireGuestsToLogin is enabled, config sanitization disables guest view, exec, and logs permissions, but leaves kill unchanged: - service/internal/config/sanitize.go:160 Specifically: - DefaultPermissions.View = false - DefaultPermissions.Exec = false - DefaultPermissions.Logs = false - DefaultPermissions.Kill remains unchanged As a result, in the default configuration path where Kill remains allowed, an unauthenticated guest user can still satisfy IsAllowedKill(): - service/internal/acl/acl.go:133 I validated this behavior on a cl


Mitigations:

Architectural layers (MAESTRO):