Peppermint CVE-2026-85392

Requires a valid authenticated session in the Peppermint instance (PR:L - any account, including the lowest-privilege role, suffices). The attacker must also know or enumerate the target user's ID; if IDs are sequential integers, enumeration requires no special capability. No special server configuration, enabled features, or elevated privileges are needed beyond basic login - the vulnerable endpoint is present in the default deployment through version 0.5.5. Exploitation is limited to session termination (the victim user is forced to re-authenticate); it does not expose credentials, data, or enable persistent unauthorized access. The impact is further bounded to the Peppermint application itself and does not affect the underlying host or adjacent systems.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) accurately captures the threat profile: low-complexity network exploitation requiring only a valid low-privilege account, with impact confined to session availability at the vulnerable system level. The score of 5.3 is proportionate - even a mid-sized support team in ustka running Peppermint as their internal helpdesk should treat this as a meaningful insider or compromised-credential risk, since a single standard agent account can repeatedly evict all administrator sessions, potentially disrupting incident response or administrative tasks. The 'Authentication Bypass' tag is a loose fit; this is an IDOR on session deletion, not a bypass of the authentication mechanism itself. No KEV listing and no confirmed public exploit code keep this in the routine patching category. The primary real-world concern is abuse by disgruntled insiders or as a nuisance/disruption primitive chained with other actions.

An authenticated standard support-agent account sends GET /api/v1/auth/user/{admin_id}/logout to the Peppermint API, substituting the numeric or UUID user ID of an administrator - trivially enumerable if IDs are sequential integers or exposed elsewhere in the application. The endpoint deletes the administrator's session without any ownership check, forcing an immediate logout. An attacker could repeat this in a loop to persistently deny administrator access during a sensitive window such as an active incident response.