What is the CVSS score of EUVD-2026-56031?

EUVD-2026-56031 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Peppermint are affected by EUVD-2026-56031?

The Peppermint helpdesk platform contains a vulnerability (CVE-2026-72561) allowing any helpdesk staff member to reconfigure your organization's authentication system to redirect all user logins to…

How to fix or mitigate EUVD-2026-56031?

Within 24 hours: Immediately inventory all Peppermint deployments to identify systems running the vulnerable version (through commit ba6e217); review OIDC configuration logs for unauthorized changes; and implement access restrictions to prevent helpdesk agents from modifying SSO settings. Within 7 days: Disable OIDC/SSO authentication if operationally feasible and transition to MFA-protected basic authentication; audit your current OIDC issuer configuration for evidence of tampering; and force re-authentication of all users to clear any attacker-created sessions. Within 30 days: Monitor Peppermint security advisories for a vendor-released patch; prepare and validate an upgrade procedure for the patched version; and implement network controls to isolate critical authentication infrastructure from standard helpdesk operations.

Peppermint EUVD-2026-56031

| CVE-2026-72561 HIGH

Improper Access Control (CWE-284)

2026-08-11 TuranSec

GHSA-68fr-jcrp-77h3

Authentication Bypass Peppermint Peppermint Lab

8.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible endpoint requires only a low-privilege authenticated session; no special conditions, with high C/I/A reflecting global SSO takeover and credential harvesting impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:13 vuln.today

CVE Published

Aug 11, 2026 - 11:12 cve.org

HIGH 8.8

DescriptionCVE.org

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before applying new OIDC issuer settings. An attacker can redirect all SSO logins to an attacker-controlled identity provider, enabling credential harvesting for all platform users.

AnalysisAI

Broken access control in Peppermint Lab's Peppermint helpdesk platform (through commit ba6e217) allows any authenticated non-administrative user to overwrite platform-wide OIDC/SSO configuration via an unprotected endpoint, enabling full credential harvesting against all platform users. The configuration endpoint applies new OIDC issuer settings without performing any administrative role check (CWE-284), meaning a low-privilege helpdesk agent can silently redirect all SSO logins to an attacker-controlled identity provider. CVSS scores 8.8 (High); no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Peppermint is an open-source helpdesk and ticketing platform developed by Peppermint Lab. The affected component is an administrative API endpoint responsible for configuring OpenID Connect (OIDC) and Single Sign-On (SSO) settings at the platform level. OIDC is the identity layer on top of OAuth 2.0 that governs which identity provider (IDP) authenticates users; replacing the issuer URL effectively hijacks the entire authentication flow for all users. The root cause is CWE-284 (Improper Access Control): the endpoint accepts and applies issuer configuration changes from any authenticated session without enforcing that the caller holds an administrative role. The affected CPE is cpe:2.3:a:peppermint_lab:peppermint:*:*:*:*:*:*:*:* across all versions through commit ba6e217, as confirmed by EUVD-2026-56031.

RemediationAI

No vendor-released patched version has been confirmed from the available data - the reference points to the Peppermint-Lab/peppermint GitHub repository (https://github.com/Peppermint-Lab/peppermint) without identifying a specific fixed release or remediation commit. Administrators should monitor the repository for patches addressing this endpoint's access control. As a compensating control, if OIDC/SSO is not actively in use, disable the feature entirely to eliminate the attack surface - note this will require users to authenticate via alternative methods. If SSO is operationally required, restrict network access to the OIDC configuration endpoint at the web server or firewall layer so only known administrative source IPs can reach it; this reduces but does not eliminate risk if the admin network is shared. Additionally, implement monitoring and alerting for any changes to the OIDC issuer URL in platform logs to detect unauthorized reconfiguration attempts. Organizations should treat this as a critical-priority patch deployment once a fix is released given the credential harvesting potential.