What is the CVSS score of CVE-2026-72555?

CVE-2026-72555 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Peppermint are affected by CVE-2026-72555?

Peppermint helpdesk contains a critical access control bypass (CVE-2026-72555, CVSS 8.1) where any authenticated employee can read, modify, or delete all support tickets, client records, and user…

How to fix or mitigate CVE-2026-72555?

Within 24 hours, inventory all Peppermint helpdesk instances in production, verify whether Config.roles_active is set to false (indicating default vulnerable configuration), and assess what customer or sensitive data is stored. Within 7 days, restrict new account creation to trusted administrators only, enable audit logging of all ticket, client, and user data access if available, and review recent access logs for unauthorized activity. Within 30 days, either apply a patched version once released by the vendor or migrate customer data to an alternative helpdesk platform with functioning access controls; do not delay-this vulnerability affects core business data integrity.

Peppermint CVE-2026-72555

EUVD-2026-56025 HIGH

Improper Access Control (CWE-284)

2026-08-11 TuranSec

GHSA-jv42-7r5q-7p5r

Authentication Bypass Peppermint Peppermint Lab

8.1

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.3 HIGH

PR:L reflects mandatory authentication; A:L added over NVD's A:N because deletion of tickets, clients, and users constitutes meaningful availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:11 vuln.today

CVE Published

Aug 11, 2026 - 11:11 cve.org

HIGH 8.1

DescriptionCVE.org

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass ownership and administrative access controls. An attacker with any user account can read, modify, or delete tickets, clients, and users belonging to any other account.

AnalysisAI

Broken access control in Peppermint helpdesk (through commit ba6e217) allows any authenticated user to read, modify, or delete tickets, clients, and users owned by any other account. The root cause is that the Config.roles_active flag defaults to false on all default installations, rendering every permission check on ticket, client, and user handlers a no-op - ownership and administrative access controls are silently bypassed. No public exploit code or active exploitation has been identified at time of analysis, but the flaw is trivially exploitable by any user with a valid account on a default-configured instance.

Technical ContextAI

Peppermint is an open-source helpdesk and ticket management application by Peppermint Lab (CPE: cpe:2.3:a:peppermint_lab:peppermint:*:*:*:*:*:*:*:*). The vulnerability is classified as CWE-284 (Improper Access Control). The application's authorization layer relies on a global flag, Config.roles_active, to gate all role-based permission checks across ticket, client, and user route handlers. Because this flag defaults to false, the conditional logic that enforces ownership and administrative boundaries evaluates to a no-op on every default deployment - the checks are present in code but never executed. This is a classic misconfiguration-as-default flaw rather than a logic inversion bug: the feature exists but ships disabled, leaving no access enforcement in place unless an administrator explicitly enables role checking.

RemediationAI

No vendor-released patched version has been independently confirmed at time of analysis - the only reference points to the upstream GitHub repository (https://github.com/Peppermint-Lab/peppermint) rather than a tagged release or security advisory. Operators should monitor that repository for commits or releases that address the Config.roles_active default. As an immediate compensating control, administrators should locate the application configuration and explicitly set Config.roles_active to true, then validate that role-based permission checks are enforced across ticket, client, and user endpoints. If the configuration cannot be changed without redeployment, restricting Peppermint access to a single-organization trust boundary (i.e., ensuring no untrusted users can register or log in) significantly reduces the practical attack surface, at the trade-off of eliminating any multi-tenant or customer-portal use case. Network-level controls such as placing Peppermint behind a VPN or IP allowlist reduce exposure to external attackers but do not address insider or lateral-movement scenarios.