CVE-2026-111353

Versions of Peppermint through 0.5.5 are vulnerable to a missing authorization flaw (CWE-862). This issue allows any authenticated user to create time entries and file attachments as different users by providing a specific user ID in the request body. Vulnerable endpoints include /api/v1/time/new...