What is the CVSS score of CVE-2026-111353?

CVE-2026-111353 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.2%.

Peppermint CVE-2026-111353

EUVD-2026-102497 MEDIUM

Missing Authorization (CWE-862)

2026-10-15 VulnCheck

GHSA-988q-6ph7-3qfp

Authentication Bypass Peppermint Peppermint Lab

5.3

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate with any valid account
Exploit

Craft POST to /time/new or /storage upload with victim user id
Execution

Server skips ownership check
Impact

Time entry or attachment created under victim identity

Vulnerability Assessment

Weakness	CWE CWE-862 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Authorization checks on every request MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires a valid authenticated Peppermint account (PR:L) - the attacker must already be able to log in; the flaw is reachable against default configurations because the /api/v1/time/new and /api/v1/storage/ticket/:id/upload/single endpoints accept a caller-supplied user id and perform no ownership/authorization check. No user interaction, special feature toggle, or non-default setting is needed, but exploitation is limited to tampering with time entries and attachment records (integrity only) and does not grant data disclosure or service disruption. The principal limiting factor is the prerequisite of authentication to the target instance.
Impact	This is a moderate, authenticated integrity issue rather than a high-urgency priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 score are internally consistent with the description: exploitation is network-reachable and low-complexity but requires an already-authenticated account (PR:L), and the only impact is to integrity (VI:L), with no confidentiality (VC:N) or availability (VA:N) effect and no scope change. No EPSS probability, CISA KEV listing, or POC flag is present in the input, so there is no signal of active or widespread exploitation; the references (a hackmd write-up and a VulnCheck advisory) describe the flaw but no public exploit is flagged. Signals are therefore consistent, not conflicting - the main caveat is that the real-world impact (forging time entries/attachments under another user's identity) is limited to data-integrity and attribution tampering within the ticketing system, which keeps genuine risk modest despite trivial exploitability for any logged-in user.
Exploit ScenarioDerived	A low-privileged but authenticated Peppermint user sends a POST request to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single and includes another user's id in the request body. Because the endpoints never verify that the supplied user id matches the authenticated session, the attacker creates time records or uploads file attachments attributed to a victim on any ticket. No public exploit is identified at time of analysis, but the request is trivial to craft.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 15, 2026

Missing authorization in Peppermint through 0.5.5 allows any authenticated user to create time entries and upload attachments under another user's identity by supplying a target user id in the request body. The flaw affects the POST /api/v1/time/new and POST /api/v1/storage/ticket/:id/upload/single endpoints, which accept a caller-controlled user id without performing any ownership or permission check. Exploitation requires a valid Peppermint account (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N vector), needs no user interaction or non-default configuration, and is limited to integrity tampering - no data disclosure or denial of service is achievable. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.

RemediationAI

No vendor-released patch or fixed version has been identified at time of analysis; no patched release, GitHub PR, or commit addressing this flaw appears in the provided references, so remediation must currently rely on compensating controls. The most effective mitigation is to add an upstream authorization layer - for example a reverse-proxy or API-gateway rule that strips or overrides any client-supplied user id on POST /api/v1/time/new and POST /api/v1/storage/ticket/:id/upload/single and forces it to the session principal, though this requires custom code and careful testing to avoid breaking legitimate clients. Alternatively, restrict network access to these API routes to trusted internal networks or require an outbound-verified identity header, accepting that this reduces usability for remote agents and self-service portals. Because exploitation requires an authenticated account, tightening account provisioning, enforcing least privilege on helpdesk roles, and monitoring audit logs for time entries or attachments attributed to unexpected user ids can detect abuse, but these are detective rather than preventive. Track the vendor repository and the VulnCheck advisory (https://www.vulncheck.com/advisories/peppermint-through-0.5.5-missing-authorization-via-time-tracking-and-attachment-upload-endpoints) for a patched release and upgrade immediately once an exact fix version is published.

Affected VersionsENISA

Peppermint 0 ≤0.5.5

Affected Packages

euvd peppermint no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is a classic CWE-862 Missing Authorization defect in the Peppermint helpdesk/ticketing platform, an open-source application whose API is built on a Node.js/TypeScript stack (with the referenced controllers living under apps/api/src). The endpoints in question - the time-tracking handler in apps/api/src/controllers/time.ts and the single-file attachment upload handler in apps/api/src/controllers/storage.ts, with routing wired up in apps/api/src/main.ts - trust a user id supplied in the request body and write records using that identity rather than deriving the actor from the authenticated session. Because no ownership check is performed against the authenticated principal, a low-privileged logged-in user can attribute time logs and file attachments to arbitrary other users or tickets. The CPE entry cpe:2.3:a:peppermint-lab:peppermint:*:*:*:*:*:*:*:* confirms the affected product family is Peppermint Lab's Peppermint at versions through 0.5.5. The impact is confined to integrity (I:L) with no confidentiality or availability effect, consistent with an authorization-logic defect in write-only record creation paths.

Know when Peppermint gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

vuln.today AI 4.3 MEDIUM

Network-reachable, low-complexity, but needs any authenticated account so PR:L; only data integrity is affected (I:L), with no confidentiality or availability impact and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

Low

Vulnerable system: Availability

None

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.

Threat Intelligence Overview

EPSS Score

0.2%

Top 85% exploitable

Prevalence

Low

niche self-hosted open-source helpdesk/ticketing tool, limited enterprise footprint

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS CIRCL

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.