Executive brief
Peppermint is an open-source issue tracking and help desk solution used as an alternative to Zendesk or Jira. The application contains a flaw in its logout API endpoint that allows any authenticated user to forcibly log out any other user, including administrators. An attacker with valid credentials can exploit this to disrupt service availability and force administrators offline, potentially blocking legitimate operations.
Technical details
The vulnerability is an authorization bypass in the GET /api/v1/auth/user/:id/logout endpoint that fails to validate whether the authenticated user owns the target account. An authenticated attacker can supply arbitrary user IDs in the endpoint URL and trigger logout operations for any user in the system. The endpoint performs no ownership or role-based access control checks before executing the logout handler. This allows session hijacking and denial-of-service attacks against any user account. The vulnerability affects Peppermint through version 0.5.5; the project has been archived as of July 2026.
Affected products
- Peppermint Lab Peppermint through 0.5.5
Timeline
- 2026-09-03: disclosed