Peppermint
Monthly
Unauthenticated session-token forgery in Peppermint (an open-source self-hosted helpdesk/ticketing platform) versions through 0.5.5 lets any remote attacker impersonate arbitrary users. The application's docker-compose.yml ships a hardcoded JWT signing secret that is public in the project repository, so an attacker who knows the secret can mint valid tokens for any user ID - including administrators - and reach protected API endpoints without credentials. Reported by VulnCheck; no public exploit identified at time of analysis, though the 'exploit' is trivially the published secret itself.
Broken access control in Peppermint Lab's Peppermint helpdesk platform (through commit ba6e217) allows any authenticated non-administrative user to overwrite platform-wide OIDC/SSO configuration via an unprotected endpoint, enabling full credential harvesting against all platform users. The configuration endpoint applies new OIDC issuer settings without performing any administrative role check (CWE-284), meaning a low-privilege helpdesk agent can silently redirect all SSO logins to an attacker-controlled identity provider. CVSS scores 8.8 (High); no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in Peppermint helpdesk (through commit ba6e217) allows any authenticated user to read, modify, or delete tickets, clients, and users owned by any other account. The root cause is that the `Config.roles_active` flag defaults to `false` on all default installations, rendering every permission check on ticket, client, and user handlers a no-op - ownership and administrative access controls are silently bypassed. No public exploit code or active exploitation has been identified at time of analysis, but the flaw is trivially exploitable by any user with a valid account on a default-configured instance.
Session invalidation without authorization in Peppermint through 0.5.5 allows any authenticated user to forcibly terminate the active sessions of any other account - including administrators - by supplying a victim's user ID to the GET /api/v1/auth/user/:id/logout endpoint, which performs no ownership check. The flaw (CWE-639) is traceable to the logout handler in apps/api/src/controllers/auth.ts and is documented in GitHub issue #529. No public exploit confirmed at time of analysis, and CVSS 4.0 scores this at 5.3, reflecting the limited direct impact (session termination only, no data exposure).
Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the Tickets page via a crafted request. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated session-token forgery in Peppermint (an open-source self-hosted helpdesk/ticketing platform) versions through 0.5.5 lets any remote attacker impersonate arbitrary users. The application's docker-compose.yml ships a hardcoded JWT signing secret that is public in the project repository, so an attacker who knows the secret can mint valid tokens for any user ID - including administrators - and reach protected API endpoints without credentials. Reported by VulnCheck; no public exploit identified at time of analysis, though the 'exploit' is trivially the published secret itself.
Broken access control in Peppermint Lab's Peppermint helpdesk platform (through commit ba6e217) allows any authenticated non-administrative user to overwrite platform-wide OIDC/SSO configuration via an unprotected endpoint, enabling full credential harvesting against all platform users. The configuration endpoint applies new OIDC issuer settings without performing any administrative role check (CWE-284), meaning a low-privilege helpdesk agent can silently redirect all SSO logins to an attacker-controlled identity provider. CVSS scores 8.8 (High); no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in Peppermint helpdesk (through commit ba6e217) allows any authenticated user to read, modify, or delete tickets, clients, and users owned by any other account. The root cause is that the `Config.roles_active` flag defaults to `false` on all default installations, rendering every permission check on ticket, client, and user handlers a no-op - ownership and administrative access controls are silently bypassed. No public exploit code or active exploitation has been identified at time of analysis, but the flaw is trivially exploitable by any user with a valid account on a default-configured instance.
Session invalidation without authorization in Peppermint through 0.5.5 allows any authenticated user to forcibly terminate the active sessions of any other account - including administrators - by supplying a victim's user ID to the GET /api/v1/auth/user/:id/logout endpoint, which performs no ownership check. The flaw (CWE-639) is traceable to the logout handler in apps/api/src/controllers/auth.ts and is documented in GitHub issue #529. No public exploit confirmed at time of analysis, and CVSS 4.0 scores this at 5.3, reflecting the limited direct impact (session termination only, no data exposure).
Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the Tickets page via a crafted request. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.