CVE-2026-85392

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85392
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85392.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85392
Published
2026-09-03T18:54:25.208Z
Modified
2026-09-04T03:47:32.488071671Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint
Details

Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85392.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ]
}
References

Affected packages

Git / github.com/peppermint-lab/peppermint

Affected ranges

Type
GIT
Repo
https://github.com/peppermint-lab/peppermint
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
71ae71ba78e1d605bc4b178342710cc7f1dc3714
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.5.5"
        }
    ]
}

Affected versions

0.*
0.1
0.1.5
0.1.6
0.1.7.5
0.1.7.7
0.1.7.8
0.1.8.5
0.1.9
0.2
0.2.1
0.2.2
0.2.3
0.3
0.3.2
0.3.3
0.3.4
0.3.5
0.4
0.4.2
0.4.6
0.4.7
0.4.8
0.5.1
0.5.2
0.5.3.1
0.5.3.2
0.5.4.2
0.5.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85392.json"