Executive brief
Peppermint is an open-source issue management and help desk platform used to track tickets, clients, and users. A configuration error causes permission checks to be disabled by default, allowing any authenticated user to read, modify, or delete tickets, clients, and user accounts belonging to other users—effectively turning access controls off for all default installations.
Technical details
The vulnerability is a broken access control issue in Peppermint's permission checking logic. The root cause is that the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops (perform no validation). An authenticated attacker can bypass ownership and administrative access controls by default, gaining the ability to read, modify, or delete any ticket, client, or user record regardless of ownership. The vulnerability affects all default installations through commit ba6e217. No patch status is explicitly documented in the advisory.
Affected products
- Peppermint Lab Peppermint through commit ba6e217
Timeline
- 2026-08-11: disclosed