Peppermint
Monthly
Unauthenticated session-token forgery in Peppermint (an open-source self-hosted helpdesk/ticketing platform) versions through 0.5.5 lets any remote attacker impersonate arbitrary users. The application's docker-compose.yml ships a hardcoded JWT signing secret that is public in the project repository, so an attacker who knows the secret can mint valid tokens for any user ID - including administrators - and reach protected API endpoints without credentials. Reported by VulnCheck; no public exploit identified at time of analysis, though the 'exploit' is trivially the published secret itself.
Broken access control in Peppermint Lab's Peppermint helpdesk platform (through commit ba6e217) allows any authenticated non-administrative user to overwrite platform-wide OIDC/SSO configuration via an unprotected endpoint, enabling full credential harvesting against all platform users. The configuration endpoint applies new OIDC issuer settings without performing any administrative role check (CWE-284), meaning a low-privilege helpdesk agent can silently redirect all SSO logins to an attacker-controlled identity provider. CVSS scores 8.8 (High); no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in Peppermint helpdesk (through commit ba6e217) allows any authenticated user to read, modify, or delete tickets, clients, and users owned by any other account. The root cause is that the `Config.roles_active` flag defaults to `false` on all default installations, rendering every permission check on ticket, client, and user handlers a no-op - ownership and administrative access controls are silently bypassed. No public exploit code or active exploitation has been identified at time of analysis, but the flaw is trivially exploitable by any user with a valid account on a default-configured instance.
Missing authorization in Peppermint through 0.5.5 allows any authenticated user to create time entries and upload attachments under another user's identity by supplying a target user id in the request body. The flaw affects the POST /api/v1/time/new and POST /api/v1/storage/ticket/:id/upload/single endpoints, which accept a caller-controlled user id without performing any ownership or permission check. Exploitation requires a valid Peppermint account (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N vector), needs no user interaction or non-default configuration, and is limited to integrity tampering - no data disclosure or denial of service is achievable. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Session invalidation without authorization in Peppermint through 0.5.5 allows any authenticated user to forcibly terminate the active sessions of any other account - including administrators - by supplying a victim's user ID to the GET /api/v1/auth/user/:id/logout endpoint, which performs no ownership check. The flaw (CWE-639) is traceable to the logout handler in apps/api/src/controllers/auth.ts and is documented in GitHub issue #529. No public exploit confirmed at time of analysis, and CVSS 4.0 scores this at 5.3, reflecting the limited direct impact (session termination only, no data exposure).
Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the Tickets page via a crafted request. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated session-token forgery in Peppermint (an open-source self-hosted helpdesk/ticketing platform) versions through 0.5.5 lets any remote attacker impersonate arbitrary users. The application's docker-compose.yml ships a hardcoded JWT signing secret that is public in the project repository, so an attacker who knows the secret can mint valid tokens for any user ID - including administrators - and reach protected API endpoints without credentials. Reported by VulnCheck; no public exploit identified at time of analysis, though the 'exploit' is trivially the published secret itself.
Broken access control in Peppermint Lab's Peppermint helpdesk platform (through commit ba6e217) allows any authenticated non-administrative user to overwrite platform-wide OIDC/SSO configuration via an unprotected endpoint, enabling full credential harvesting against all platform users. The configuration endpoint applies new OIDC issuer settings without performing any administrative role check (CWE-284), meaning a low-privilege helpdesk agent can silently redirect all SSO logins to an attacker-controlled identity provider. CVSS scores 8.8 (High); no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Broken access control in Peppermint helpdesk (through commit ba6e217) allows any authenticated user to read, modify, or delete tickets, clients, and users owned by any other account. The root cause is that the `Config.roles_active` flag defaults to `false` on all default installations, rendering every permission check on ticket, client, and user handlers a no-op - ownership and administrative access controls are silently bypassed. No public exploit code or active exploitation has been identified at time of analysis, but the flaw is trivially exploitable by any user with a valid account on a default-configured instance.
Missing authorization in Peppermint through 0.5.5 allows any authenticated user to create time entries and upload attachments under another user's identity by supplying a target user id in the request body. The flaw affects the POST /api/v1/time/new and POST /api/v1/storage/ticket/:id/upload/single endpoints, which accept a caller-controlled user id without performing any ownership or permission check. Exploitation requires a valid Peppermint account (PR:L in the assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N vector), needs no user interaction or non-default configuration, and is limited to integrity tampering - no data disclosure or denial of service is achievable. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Session invalidation without authorization in Peppermint through 0.5.5 allows any authenticated user to forcibly terminate the active sessions of any other account - including administrators - by supplying a victim's user ID to the GET /api/v1/auth/user/:id/logout endpoint, which performs no ownership check. The flaw (CWE-639) is traceable to the logout handler in apps/api/src/controllers/auth.ts and is documented in GitHub issue #529. No public exploit confirmed at time of analysis, and CVSS 4.0 scores this at 5.3, reflecting the limited direct impact (session termination only, no data exposure).
Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the Tickets page via a crafted request. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.