### Summary

OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are
not allowed to view, resulting in broken access control and sensitive information disclosure. I validated this on OliveTin 3000.10.2.




### Details
The issue is in the live event streaming path.

EventStream() only checks whether the caller may access the dashboard, then registers the user as a stream subscriber:

- service/internal/api/api.go:776

After subscription, execution events are broadcast to all connected clients without checking whether each recipient is authorized to view logs for the action:

- service/internal/api/api.go:846 OnExecutionStarted
- service/internal/api/api.go:869 OnExecutionFinished
- service/internal/api/api.go:1047 OnOutputChunk

The event payload includes action output through:

- service/internal/api/api.go:295 internalLogEntryToPb
- service/internal/api/api.go:302 Output

By contrast, the normal log APIs do apply per-action authorization checks:

- service/internal/api/api.go:518 GetLogs
- service/internal/api/api.go:585 GetActionLogs
- service/internal/api/api.go:544 isLogEntryAllowed

Root cause:

- the subscription path enforces only coarse dashboard access
- execution callbacks broadcast to every connected client
- no per-recipient ACL check is applied before sending action metadata or output

I validated the issue using:

- an admin user with full ACLs
- an alice user with no ACLs
- a protected action that outputs TOPSECRET=alpha-bravo-charlie

Despite having no relevant ACLs, alice still receives the ExecutionFinished event for the privileged action, including the protected output.



### PoC
Tested version:
```
- 3000.10.2
```
1. Fetch and check out 3000.10.2 in a clean worktree:
```bash
git -C OliveTin fetch origin tag 3000.10.2
git -C OliveTin worktree add /home/kali/CVE/OliveTin-3000.10.2 3000.10.2
```
2. Copy the PoC test into the clean tree:
```bash
cp OliveTin/service/internal/api/event_stream_leak_test.go \
OliveTin-3000.10.2/service/internal/api/
```
3. Run the targeted PoC test:
```bash
cd OliveTin-3000.10.2/service
go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v
```
4. Optional: save validation output:
```bash
go test ./internal/api -run TestEventStreamLeaksUnauthorizedExecutionOutput -count=1 -timeout 30s -v \
2>&1 | tee /tmp/olivetin_eventstream_3000.10.2.log
```
Observed validation output:
```bash
=== RUN TestEventStreamLeaksUnauthorizedExecutionOutput
time="2026-03-01T04:44:59-05:00" level=info msg="Action requested" actionTitle=secret-action tags="[]"
time="2026-03-01T04:44:59-05:00" level=info msg="Action parse args - Before" actionTitle=secret-action cmd="echo 'TOPSECRET=alpha-bravo-charlie'"
time="2026-03-01T04:44:59-05:00" level=info msg="Action parse args - After" actionTitle=secret-action cmd="echo 'TOPSECRET=alpha-bravo-charlie'"
time="2026-03-01T04:44:59-05:00" level=info msg="Action started" actionTitle=secret-action timeout=1
time="2026-03-01T04:44:59-05:00" level=info msg="Action finished" actionTitle=secret-action exit=0 outputLength=30 timedOut=false
--- PASS: TestEventStreamLeaksUnauthorizedExecutionOutput (0.00s)
PASS
ok github.com/OliveTin/OliveTin/internal/api 0.025s
```
What this proves:

- admin can execute the protected action
- alice has no ACLs
- alice still receives the streamed completion event for the protected action
- protected action output is exposed through the event stream


### Impact
This is an authenticated broken access control / information disclosure vulnerability.

A low-privileged authenticated user can subscribe to EventStream and receive:

- action execution metadata
- execution tracking IDs
- initiating username
- live output chunks
- final command output

Who is impacted:

- multi-user OliveTin deployments
- environments where privileged actions produce secrets, tokens, internal system details, or other sensitive operational output
- deployments where lower-privileged authenticated users can access the dashboard and subscribe to live events

This bypasses intended per-action log/view restrictions for protected actions.

CWE-284 Improper Access Control

CWE-863 Incorrect Authorization