GCVE - cpe:2.3:a:peppermint-lab:peppermint:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:peppermint-lab:peppermint:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Peppermint Lab (`9163fa34-feaf-58aa-9bc7-f49c1dfcc4b1`)
Product	Peppermint (`7621c886-784d-5c46-bc7c-afc0d6ef482d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-111353`	vulnerable	2026-11-03 10:16:11.123434	Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints MEDIUM (4.3) Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity. Published: 2026-10-15T21:43:43.068Z Updated: 2026-10-21T01:47:26.201Z Open on db.gcve.eu Reference links https://hackmd.io/@hieuPenguinnn/peppermint-data-logs-missing-authorization https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/time.ts#L6-L27 https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/storage.ts#L9-L35 https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/main.ts#L57-L70 https://www.vulncheck.com/advisories/peppermint-through-0.5.5-missing-authorization-via-time-tracking-and-attachment-upload-endpoints	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.