CVE-2026-48709 OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration
Unauthenticated attackers can enumerate valid action IDs and argument configurations via the ValidateArgumentType endpoint when guest login is required.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48709?
CVE-2026-48709 is a low-severity missing authorization vulnerability in OliveTin, published on 15 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not call auth.UserFromApiCall or checkDashboardAccess. When AuthRequireGuestsToLogin is enabled (the security-conscious configuration), this endpoint remains accessible to unauthenticated users and can be used as an oracle to enumerate valid action binding IDs and their argument configurations. This issue has been fixed in version 3000.13.0.
Weakness: CWE-862
Which versions are affected by CVE-2026-48709?
3 open source packages ship an affected version, including github.com/OliveTin/OliveTin.
| Package | Affected | Fixed in |
|---|---|---|
github.com/OliveTin/OliveTin Go | All versions | 0.0.0-20260521230847-a3865704c854 |
github.com/OliveTin/OliveTin Go | All versions | 0.0.0-20260521230847-a3865704c854 |
github.com/OliveTin/OliveTin Go | All versions | 0.0.0-20260521230847-a3865704c854 |
How do I fix CVE-2026-48709?
Upgrade github.com/OliveTin/OliveTin to 0.0.0-20260521230847-a3865704c854 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-48709 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48709 exists.
Sources
Also known as GHSA-f637-w7p2-m7fx, GO-2026-5347.