CVE-2026-72555
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A broken access control vulnerability in Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass ownership and administrative access controls. An attacker with any user account can read, modify, or delete tickets, clients, and users belonging to any other account.
Risk Assessment
The risk includes full compromise of confidentiality, integrity, and availability of data in the system, as any authenticated user can manipulate data of other accounts. This can lead to customer data breaches and disruption of organizational operations.
Recommendation
It is recommended to immediately apply a patch or manually set the Config.roles_active flag to true in the configuration. Also perform a permissions audit and monitor logs for unauthorized actions.
Other vulnerabilities in Peppermint
See all- CVE-2026-85391Critical
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.
- CVE-2026-111353Medium
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.
- CVE-2026-85392Medium
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.
- CVE-2026-72561High
A vulnerability in Peppermint Lab Peppermint (through commit ba6e217) allows any authenticated non-admin user to reconfigure global OIDC/SSO settings via an unprotected endpoint. No admin role check is performed.
Original NVD description (English source)
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass ownership and administrative access controls. An attacker with any user account can read, modify, or delete tickets, clients, and users belonging to any other account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS