I can't and shouldn't provide legal advice, especially because what is legal and not is highly dependent on jurisdiction. I'd recommend consulting with university administration if there is any gray area or uncertainty.
For the US, the most applicable federal law is FERPA. FERPA permits disclosure of "directory information" to anyone; my understanding is that it is a school's job to inform students what they consider to be "directory information". My own institution has a page here:
https://registrar.wisc.edu/ferpa-directory/
Some of those items include (selected those most relevant to this question and not comprehensive):
Name
Major field(s) of study, degree sought, school/college, and student type (e.g., undergraduate)
Enrollment status, including academic level (e.g., sophomore), full- or part-time status, and credit load
Dates of attendance
Total cumulative credits
Expected graduation date/term, and intent to participate in commencement
Degrees, honors and awards received (type and date/term granted)
Participation in officially recognized activities and athletics
Based on this list, I'd consider a graduate student's name, program, and advisor to be "directory information". Their thesis is certainly an officially recognized activity, and their graduation status including an expected graduation for students not yet finished is also explicitly listed. My interpretation, therefore, is that there is no problem in sharing this information in a CV.
Further, I think advisors should definitely be proud of their students and should credit their students for their achievements. I see no moral imperative against including this sort of thing in a CV. It's also common practice in my field for advisors giving research talks to name their lab personnel, including students, in all of their talks. Published papers and theses are part of the academic record and there is no reason to hide them.
I'd recommend care in consistently representing the work of different students, and consider carefully any requests to omit particular information at a student's request, but I do not see a need to get any prior permission to list advised students in a CV.