Peppermint
Approved changes feed: RSS · Atom
cpe:2.3:a:peppermint_lab:peppermint:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Peppermint Lab (f50472ea-6106-5d01-a0a8-8b080f803e85) |
|---|---|
| Product | Peppermint (e28263ee-ab10-508d-9eec-6fa487993054) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-72555 |
vulnerable | 2026-09-16 04:33:08.703002 |
Peppermint Lab Peppermint - Broken Access Control
HIGH (8.1)
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass ownership and administrative access controls. An attacker with any user account can read, modify, or delete tickets, clients, and users belonging to any other account.
Published: 2026-08-11T11:11:27.080Z
Updated: 2026-08-11T15:17:45.232Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-72561 |
vulnerable | 2026-09-16 04:33:08.611801 |
Peppermint Lab Peppermint - Broken Access Control
HIGH (8.8)
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before applying new OIDC issuer settings. An attacker can redirect all SSO logins to an attacker-controlled identity provider, enabling credential harvesting for all platform users.
Published: 2026-08-11T11:12:48.863Z
Updated: 2026-08-11T12:18:54.557Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.