EUVD-2026-70669
GHSA-r5f6-fc86-75rh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L required (valid account needed); A:L since impact is per-user session termination only, not full service disruption; no C or I impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.
AnalysisAI
Session invalidation without authorization in Peppermint through 0.5.5 allows any authenticated user to forcibly terminate the active sessions of any other account - including administrators - by supplying a victim's user ID to the GET /api/v1/auth/user/:id/logout endpoint, which performs no ownership check. The flaw (CWE-639) is traceable to the logout handler in apps/api/src/controllers/auth.ts and is documented in GitHub issue #529. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated session in the Peppermint instance (PR:L - any account, including the lowest-privilege role, suffices). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) accurately captures the threat profile: low-complexity network exploitation requiring only a valid low-privilege account, with impact confined to session availability at the vulnerable system level. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis - no fixed release version appears in the available references or CPE data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Peppermint
View allAn issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and ex
An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the
Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/downl
Unauthenticated session-token forgery in Peppermint (an open-source self-hosted helpdesk/ticketing platform) versions th
Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/d
Broken access control in Peppermint Lab's Peppermint helpdesk platform (through commit ba6e217) allows any authenticated
Broken access control in Peppermint helpdesk (through commit ba6e217) allows any authenticated user to read, modify, or
Share
External POC / Exploit Code
Leaving vuln.today