CVE-2026-48709— OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration
Possible ATT&CK Techniques 3AI
T1590 · Gather Victim Network Information T1592 · Gather Victim Host Information T1083 · File and Directory DiscoveryGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-48709
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration
Source: NVD (National Vulnerability Database)
Vulnerability Description
OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not call auth.UserFromApiCall or checkDashboardAccess. When AuthRequireGuestsToLogin is enabled (the security-conscious configuration), this endpoint remains accessible to unauthenticated users and can be used as an oracle to enumerate valid action binding IDs and their argument configurations. This issue has been fixed in version 3000.13.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
OliveTin 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OliveTin是OliveTin团队开源的一个Web应用。 OliveTin 3000.0.0之前版本存在授权问题漏洞，该漏洞源于service/internal/api/api.go中的ValidateArgumentType RPC端点缺乏身份验证或授权检查，可能导致未经验证的用户枚举有效的操作绑定ID及其参数配置。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-48709
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48709
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-48709 (1)
Vendor Advisories for CVE-2026-48709 (1)
Other References for CVE-2026-48709 (1)
- 🔗 Release 3000.13.0 · OliveTin/OliveTin · GitHubx_refsource_MISC
IV. Related Vulnerabilities
Same product: OliveTin
- CVE-2026-48708
OliveTin has a Concurrent Template Parsing Race Condition wh - CVE-2026-32102
OliveTin Unauthorized Action Output Disclosure via EventStre - CVE-2026-31817
OliveTin's unsafe parsing of UniqueTrackingId can be used to - CVE-2026-30233
OliveTin: View permission not being checked when returning d - CVE-2026-30225
OliveTin: RestartAction always runs actions as guest
Same vendor: OliveTin
- CVE-2026-48708
OliveTin has a Concurrent Template Parsing Race Condition wh - CVE-2026-32102
OliveTin Unauthorized Action Output Disclosure via EventStre - CVE-2026-31817
OliveTin's unsafe parsing of UniqueTrackingId can be used to - CVE-2026-30233
OliveTin: View permission not being checked when returning d - CVE-2026-30225
OliveTin: RestartAction always runs actions as guest
Same weakness: CWE-862
- CVE-2026-59262
AFFiNE - Unauthorized Document Edit History Access via Graph - CVE-2026-56250
Capgo - Arbitrary R2 Object Deletion via Mutable r2_path in - CVE-2026-60124
MISP importModule missing authorization allows read-only use - CVE-2026-5356
LatePoint - Calendar Booking Plugin for Appointments and Eve - CVE-2026-12153
WP Learn Manager <= 1.1.8 - Missing Authorization to Unauthe
V. Comments for CVE-2026-48709
No comments yet