# OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream

OliveTin's EventStream broadcasts action execution events and output to all authenticated dashboard subscribers without per-action ACL checks, leaking protected action output to low-privileged users.

- Payout: Research
- Severity: high
- Program: OliveTin
- Found by: kule500
- Disclosed: 2026-03-12
- CVE: CVE-2026-32102
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-228v-wc5r-j8m7
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-228v-wc5r-j8m7
- Tags: area:web domain:web impact:data-leak kind:research platform:ghsa sev:high tech:go technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Live event streaming API endpoint (EventStream) in OliveTin dashboard
**Root cause:** EventStream() only enforces coarse dashboard access before registering a subscriber; execution callbacks (OnExecutionStarted/OnExecutionFinished/OnOutputChunk) broadcast to every connected client without per-recipient per-action ACL checks, unlike GetLogs/GetActionLogs which call isLogEntryAllowed.
**Steps:**
1. Check out tag 3000.10.2 in a clean worktree
2. Copy PoC test event_stream_leak_test.go into service/internal/api/
3. Run `go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v`
4. Observe alice (no ACLs) receives ExecutionFinished event with protected output `TOPSECRET=alpha-bravo-charlie` from admin-executed secret-action
**How found:** Compared the authorization model of the normal log APIs (GetLogs/GetActionLogs applying isLogEntryAllowed per entry) against the streaming path, noticing EventStream only checks dashboard access and the broadcast callbacks apply no per-recipient ACL check.
**Exploitation:** An authenticated low-privileged user subscribes to the EventStream endpoint; when a privileged user executes a protected action, the broadcast callbacks deliver execution metadata, tracking IDs, initiating username, live output chunks and final command output to the unauthorized subscriber.
**Insight:** When a product has both pull-based log APIs and push-based event streams, audit the stream path separately: per-record ACL filters applied in the REST handlers are frequently omitted in the broadcast fan-out, so diff the two code paths for the same resource.

## Proof of concept (copied exactly from the original report)

**PoC test run command for EventStream leak**

```
go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v
  4. Optional: save validation output:
  go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v \
    2>&1 | tee /tmp/olivetin_eventstream_3000.10.2.log
```

**Setup commands copying PoC test into tree**

```
git -C OliveTin fetch origin tag 3000.10.2
  git -C OliveTin worktree add /home/kali/CVE/OliveTin-3000.10.2 3000.10.2
  2. Copy the PoC test into the clean tree:
  cp OliveTin/service/internal/api/event_stream_leak_test.go \
    OliveTin-3000.10.2/service/internal/api/
```