CVE-2026-85392
MediumCVSS 4.3Summary
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.
Risk Assessment
An attacker can force logout of administrators or other users, potentially leading to session disruption, loss of access, and potential operational impact.
Recommendation
It is recommended to update Peppermint to a patched version and implement authorization checks in the logout endpoint.
Other vulnerabilities in Peppermint
See all- CVE-2026-85391Critical
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.
- CVE-2026-72561High
A vulnerability in Peppermint Lab Peppermint (through commit ba6e217) allows any authenticated non-admin user to reconfigure global OIDC/SSO settings via an unprotected endpoint. No admin role check is performed.
- CVE-2026-72555High
A broken access control vulnerability in Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass ownership and administrative access controls. An attacker with any user account can read, modify, or delete tickets, clients, and users belonging to any other account.
Original NVD description (English source)
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.