Search
Find a vulnerability
Search criteria
6 vulnerabilities by Peppermint-Lab
CVE-2026-111353 (GCVE-0-2026-111353)
Vulnerability from nvd – Published: 2026-10-15 21:43 – Updated: 2026-10-21 01:47 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints
Summary
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 01:47 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/peppermint-data-… | third-party-advisory |
| https://github.com/Peppermint-Lab/peppermint/blob… | technical-description |
| https://github.com/Peppermint-Lab/peppermint/blob… | technical-description |
| https://github.com/Peppermint-Lab/peppermint/blob… | technical-description |
| https://www.vulncheck.com/advisories/peppermint-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Peppermint-Lab | peppermint |
Affected:
0 , ≤ 0.5.5
(custom)
cpe:2.3:a:peppermint:peppermint:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111353",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T01:47:03.959706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T01:47:26.201Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/peppermint-data-logs-missing-authorization"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Peppermint-Lab/peppermint",
"product": "peppermint",
"repo": "https://github.com/Peppermint-Lab/peppermint",
"vendor": "Peppermint-Lab",
"versions": [
{
"lessThanOrEqual": "0.5.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:peppermint:peppermint:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user\u0027s identity."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:43.068Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/peppermint-data-logs-missing-authorization"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/time.ts#L6-L27"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/storage.ts#L9-L35"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/main.ts#L57-L70"
},
{
"name": "VulnCheck Advisory: Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/peppermint-through-0.5.5-missing-authorization-via-time-tracking-and-attachment-upload-endpoints"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111353",
"datePublished": "2026-10-15T21:43:43.068Z",
"dateReserved": "2026-10-15T20:55:49.173Z",
"dateUpdated": "2026-10-21T01:47:26.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85392 (GCVE-0-2026-85392)
Vulnerability from nvd – Published: 2026-09-03 18:54 – Updated: 2026-09-04 13:41
VLAI
EPSS
VEX
Title
Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint
Summary
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 13:26 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Peppermint-Lab/peppermint/issues/529 | issue-tracking |
| https://github.com/Peppermint-Lab/peppermint | product |
| https://github.com/Peppermint-Lab/peppermint/blob… | technical-description |
| https://www.vulncheck.com/advisories/peppermint-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Peppermint-Lab | peppermint |
Affected:
0 , ≤ 0.5.5
(custom)
cpe:2.3:a:peppermint:peppermint:*:*:*:*:*:*:*:* |
Date Public
2026-07-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85392",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T13:26:16.910073Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T13:41:49.143Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "peppermint",
"vendor": "Peppermint-Lab",
"versions": [
{
"lessThanOrEqual": "0.5.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:peppermint:peppermint:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user\u0027s ID, since the endpoint performs no authorization checks to verify the caller owns the target account."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T18:54:25.208Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #529",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Peppermint-Lab/peppermint/issues/529"
},
{
"tags": [
"product"
],
"url": "https://github.com/Peppermint-Lab/peppermint"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/auth.ts"
},
{
"name": "VulnCheck Advisory: Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/peppermint-through-0.5.5-authorization-bypass-on-the-user-logout-endpoint"
}
],
"title": "Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85392",
"datePublished": "2026-09-03T18:54:25.208Z",
"dateReserved": "2026-09-03T18:10:52.289Z",
"dateUpdated": "2026-09-04T13:41:49.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85391 (GCVE-0-2026-85391)
Vulnerability from nvd – Published: 2026-09-03 18:54 – Updated: 2026-09-03 19:00
VLAI
EPSS
VEX
Title
Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml
Summary
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 19:00 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Peppermint-Lab/peppermint/issues/528 | issue-tracking |
| https://github.com/Peppermint-Lab/peppermint | product |
| https://github.com/Peppermint-Lab/peppermint/blob… | technical-description |
| https://github.com/Peppermint-Lab/peppermint/blob… | technical-description |
| https://www.vulncheck.com/advisories/peppermint-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Peppermint-Lab | peppermint |
Affected:
0 , ≤ 0.5.5
(custom)
cpe:2.3:a:peppermint:peppermint:*:*:*:*:*:*:*:* |
Date Public
2026-07-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85391",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T19:00:41.202751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T19:00:50.811Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "peppermint",
"vendor": "Peppermint-Lab",
"versions": [
{
"lessThanOrEqual": "0.5.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:peppermint:peppermint:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T18:54:24.542Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #528",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Peppermint-Lab/peppermint/issues/528"
},
{
"tags": [
"product"
],
"url": "https://github.com/Peppermint-Lab/peppermint"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/docker-compose.yml"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/lib/jwt.ts"
},
{
"name": "VulnCheck Advisory: Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/peppermint-through-0.5.5-use-of-hard-coded-jwt-signing-secret-in-docker-compose-yml"
}
],
"title": "Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85391",
"datePublished": "2026-09-03T18:54:24.542Z",
"dateReserved": "2026-09-03T18:10:51.946Z",
"dateUpdated": "2026-09-03T19:00:50.811Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111353 (GCVE-0-2026-111353)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-21 01:47 Unsupported When Assigned
VLAI
EPSS
VEX
Title
Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints
Summary
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 01:47 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/peppermint-data-… | third-party-advisory |
| https://github.com/Peppermint-Lab/peppermint/blob… | technical-description |
| https://github.com/Peppermint-Lab/peppermint/blob… | technical-description |
| https://github.com/Peppermint-Lab/peppermint/blob… | technical-description |
| https://www.vulncheck.com/advisories/peppermint-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Peppermint-Lab | peppermint |
Affected:
0 , ≤ 0.5.5
(custom)
cpe:2.3:a:peppermint:peppermint:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111353",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T01:47:03.959706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T01:47:26.201Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/peppermint-data-logs-missing-authorization"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/Peppermint-Lab/peppermint",
"product": "peppermint",
"repo": "https://github.com/Peppermint-Lab/peppermint",
"vendor": "Peppermint-Lab",
"versions": [
{
"lessThanOrEqual": "0.5.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:peppermint:peppermint:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user\u0027s identity."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:43.068Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/peppermint-data-logs-missing-authorization"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/time.ts#L6-L27"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/storage.ts#L9-L35"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/main.ts#L57-L70"
},
{
"name": "VulnCheck Advisory: Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/peppermint-through-0.5.5-missing-authorization-via-time-tracking-and-attachment-upload-endpoints"
}
],
"tags": [
"unsupported-when-assigned"
],
"title": "Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111353",
"datePublished": "2026-10-15T21:43:43.068Z",
"dateReserved": "2026-10-15T20:55:49.173Z",
"dateUpdated": "2026-10-21T01:47:26.201Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85392 (GCVE-0-2026-85392)
Vulnerability from cvelistv5 – Published: 2026-09-03 18:54 – Updated: 2026-09-04 13:41
VLAI
EPSS
VEX
Title
Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint
Summary
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 13:26 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/Peppermint-Lab/peppermint/issues/529 | issue-tracking |
| https://github.com/Peppermint-Lab/peppermint | product |
| https://github.com/Peppermint-Lab/peppermint/blob… | technical-description |
| https://www.vulncheck.com/advisories/peppermint-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Peppermint-Lab | peppermint |
Affected:
0 , ≤ 0.5.5
(custom)
cpe:2.3:a:peppermint:peppermint:*:*:*:*:*:*:*:* |
Date Public
2026-07-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85392",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T13:26:16.910073Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T13:41:49.143Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "peppermint",
"vendor": "Peppermint-Lab",
"versions": [
{
"lessThanOrEqual": "0.5.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:peppermint:peppermint:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user\u0027s ID, since the endpoint performs no authorization checks to verify the caller owns the target account."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T18:54:25.208Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #529",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Peppermint-Lab/peppermint/issues/529"
},
{
"tags": [
"product"
],
"url": "https://github.com/Peppermint-Lab/peppermint"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/auth.ts"
},
{
"name": "VulnCheck Advisory: Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/peppermint-through-0.5.5-authorization-bypass-on-the-user-logout-endpoint"
}
],
"title": "Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85392",
"datePublished": "2026-09-03T18:54:25.208Z",
"dateReserved": "2026-09-03T18:10:52.289Z",
"dateUpdated": "2026-09-04T13:41:49.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85391 (GCVE-0-2026-85391)
Vulnerability from cvelistv5 – Published: 2026-09-03 18:54 – Updated: 2026-09-03 19:00
VLAI
EPSS
VEX
Title
Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml
Summary
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-03 19:00 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Peppermint-Lab/peppermint/issues/528 | issue-tracking |
| https://github.com/Peppermint-Lab/peppermint | product |
| https://github.com/Peppermint-Lab/peppermint/blob… | technical-description |
| https://github.com/Peppermint-Lab/peppermint/blob… | technical-description |
| https://www.vulncheck.com/advisories/peppermint-t… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Peppermint-Lab | peppermint |
Affected:
0 , ≤ 0.5.5
(custom)
cpe:2.3:a:peppermint:peppermint:*:*:*:*:*:*:*:* |
Date Public
2026-07-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85391",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-03T19:00:41.202751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T19:00:50.811Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "peppermint",
"vendor": "Peppermint-Lab",
"versions": [
{
"lessThanOrEqual": "0.5.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:peppermint:peppermint:*:*:*:*:*:*:*:*",
"versionEndIncluding": "0.5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-03T18:54:24.542Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #528",
"tags": [
"issue-tracking"
],
"url": "https://github.com/Peppermint-Lab/peppermint/issues/528"
},
{
"tags": [
"product"
],
"url": "https://github.com/Peppermint-Lab/peppermint"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/docker-compose.yml"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/lib/jwt.ts"
},
{
"name": "VulnCheck Advisory: Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/peppermint-through-0.5.5-use-of-hard-coded-jwt-signing-secret-in-docker-compose-yml"
}
],
"title": "Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85391",
"datePublished": "2026-09-03T18:54:24.542Z",
"dateReserved": "2026-09-03T18:10:51.946Z",
"dateUpdated": "2026-09-03T19:00:50.811Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}