EUVD-2026-102497

Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...

CVE-2026-111353

Versions of Peppermint through 0.5.5 are vulnerable to a missing authorization flaw (CWE-862). This issue allows any authenticated user to create time entries and file attachments as different users by providing a specific user ID in the request body. Vulnerable endpoints include /api/v1/time/new...