CVE-2026-72555 in Peppermint
Summary
by MITRE • 08/11/2026
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass ownership and administrative access controls. An attacker with any user account can read, modify, or delete tickets, clients, and users belonging to any other account.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical broken access control flaw in the Peppermint Lab Peppermint application where the default configuration fails to enforce proper authorization checks. The issue stems from the Config.roles_active flag being set to false by default, which effectively disables all permission validation mechanisms within the system. This configuration oversight creates a fundamental security weakness that allows any authenticated user to bypass ownership and administrative access controls entirely. The vulnerability affects core application components including ticket, client, and user handlers where permission checks are rendered ineffective due to the disabled roles flag. When this flag is false, the system operates in a permissive mode where all authorization logic becomes inactive, essentially converting the application into an open-access environment for authenticated users.
The technical implementation of this flaw demonstrates a classic misconfiguration issue that falls under CWE-284 which specifically addresses inadequate access control mechanisms. The vulnerability operates at the application level where default security settings fail to provide proper boundary enforcement between user accounts. This misconfiguration creates a scenario where the system's authorization model is completely bypassed, allowing any authenticated user to perform operations on resources belonging to other users without restriction. The impact extends across multiple resource types within the application, including tickets that may contain sensitive information, client data that represents business relationships, and user accounts that hold authentication credentials and access rights.
The operational consequences of this vulnerability are severe and far-reaching for organizations using the Peppermint application. Any attacker who gains access to a valid user account can exploit this weakness to escalate privileges and access unauthorized resources across the entire system. This creates a significant risk of data breaches, information disclosure, and potential system compromise. The flaw essentially eliminates the concept of user isolation within the application, allowing unauthorized access to sensitive business data and operational resources. Organizations may experience loss of confidential information, disruption of business processes, and potential regulatory compliance violations due to unauthorized access to protected resources.
Security mitigations for this vulnerability must address both immediate remediation and long-term configuration management practices. The primary fix involves ensuring that the Config.roles_active flag is properly configured to true in production environments, enabling the authorization system to function correctly. Organizations should implement automated configuration validation processes to verify that security settings are properly applied during deployment cycles. Additionally, regular security assessments should be conducted to identify similar misconfigurations across other application components. The solution aligns with ATT&CK technique T1548.003 which focuses on abuse of cloud service roles and permissions, emphasizing the need for proper access control configuration. System administrators must also establish robust monitoring procedures to detect unauthorized access patterns that may indicate exploitation attempts. Organizations should consider implementing principle of least privilege configurations and regular security audits to prevent similar issues from occurring in other system components or future software versions.