GHSA-JM28-2WCR-QF3H OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

Summary The synchronous execution RPCs StartActionAndWait and StartActionByGetAndWait return the full LogEntry for the just-executed action without checking whether the caller is allowed to read that action's logs. OliveTin's ACL model separates exec from logs. A deployment can intentionally allo...

PT-2026-23617

Name of the Vulnerable Software and Affected Versions OliveTin versions prior to 3000.11.1 Description OliveTin has an authorization issue where authenticated users with insufficient permissions view: false can access metadata related to actions through the dashboard and API endpoints...