124 matches found
CVE-2023-26984
CVE-2023-26984 Vulnerability Explanation: An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the Tickets page via a crafted request. Attack Vectors: The attacker had to log in with the user role and reset the password. Then intercep...
EUVD-2026-102497
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...
CVE-2026-111353
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...
CVE-2026-111353 Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...
CVE-2026-111353
Versions of Peppermint through 0.5.5 are vulnerable to a missing authorization flaw (CWE-862). This issue allows any authenticated user to create time entries and file attachments as different users by providing a specific user ID in the request body. Vulnerable endpoints include /api/v1/time/new...
CVE-2026-111353
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...
CVE-2026-111353 Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...
CVE-2026-111353 Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...
PT-2026-115297
Name of the Vulnerable Software and Affected Versions Peppermint versions prior to 0.5.6 Description An authorization flaw allows authenticated users to create time entries and attachments on behalf of other users. By providing a specific user ID in the request body, an attacker can impersonate...
CVE-2026-111353: Missing Authorization
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...
Peppermint Lab Ticket Management System authorization issue vulnerability
The Peppermint Lab Ticket Management System versions 0.5.5 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization validation; any authenticated user can create time entries and attachments under another user’s identity by providing their us...
Malicious code in elf-stats-peppermint-stocking-949 (npm)
Source: amazon-inspector bbb5ceef86f21613919365dd7efa729077eba63c28b1d901abc6229022ea4d32 The package elf-stats-peppermint-stocking-949 was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in elf-stats-peppermint-candy-233 (npm)
Source: amazon-inspector b9c09927fc4405be586a497798b2c60e046f755a35dace2f3031161b6e772800 The package elf-stats-peppermint-candy-233 was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in elf-stats-peppermint-wishlist-307 (npm)
Source: amazon-inspector fe62a90e39574207020ca4b713b10ebbc5f218dc93626332919f90826a58040b The package elf-stats-peppermint-wishlist-307 was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in elf-stats-peppermint-fir-730 (npm)
Source: amazon-inspector 5039d15c88cd29e035800670b6bd90ab44e1915d560eaf8917ef7cc175d1e86c The package elf-stats-peppermint-fir-730 was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in elf-stats-peppermint-hollyberry-893 (npm)
Source: amazon-inspector 79a963811fd8bcfe8003e4595947b7f0a2089713343390c962c68e43a1cbd0af The package elf-stats-peppermint-hollyberry-893 was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in elf-stats-peppermint-icicle-890 (npm)
Source: amazon-inspector c727f51a933587722ba2bf80261b4eaabc57929060180b6934c9f3c7b1bfebc4 The package elf-stats-peppermint-icicle-890 was found to contain malicious code. --- Credit: OpenSSF source...
CVE-2026-85391
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...
CVE-2026-85392
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling...
CVE-2026-85392 Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling...