CVE-2026-72555

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-72555

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72555.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-72555

Published

2026-08-11T11:11:27Z

Modified

2026-10-28T02:30:22Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Peppermint Lab Peppermint - Broken Access Control

Details

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass ownership and administrative access controls. An attacker with any user account can read, modify, or delete tickets, clients, and users belonging to any other account.

Database specific

{
    "cna_assigner":  "TuranSec",
    "cwe_ids":  [
        "CWE-284"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72555.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "last_affected":  "ba6e217"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/peppermint-lab/peppermint

Affected ranges

Type

GIT

Repo

https://github.com/peppermint-lab/peppermint

Events

Introduced

Last Affected

ba6e217

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "ba6e217"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72555.json"