# CVE-2026-85392: Peppermint authorization bypass in logout endpoint

Source: https://junglewise.ai/threats/cve-2026-85392-peppermint-authorization-bypass-in-logout-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85392 · Severity: medium · CVSS 4.3 · Published 2026-09-03

Peppermint is an open-source issue tracking and help desk solution used as an alternative to Zendesk or Jira. The application contains a flaw in its logout API endpoint that allows any authenticated user to forcibly log out any other user, including administrators. An attacker with valid credentials can exploit this to disrupt service availability and force administrators offline, potentially blocking legitimate operations.

Technologies: [Peppermint Lab Peppermint](https://junglewise.ai/threats/technologies/peppermint). Vendors: [Peppermint Lab](https://junglewise.ai/threats/vendors/peppermint-lab).

## Quick answers

**Is CVE-2026-85392 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85392 being exploited in the wild.

**How severe is CVE-2026-85392?** Medium severity, with a CVSS score of 4.3, published 3 September 2026.

**Which products and versions are affected?** Peppermint Lab Peppermint through 0.5.5.

**Is there a fix for CVE-2026-85392?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85392 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85392?** Check whether you run Peppermint Lab Peppermint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the GET /api/v1/auth/user/:id/logout endpoint that fails to validate whether the authenticated user owns the target account. An authenticated attacker can supply arbitrary user IDs in the endpoint URL and trigger logout operations for any user in the system. The endpoint performs no ownership or role-based access control checks before executing the logout handler. This allows session hijacking and denial-of-service attacks against any user account. The vulnerability affects Peppermint through version 0.5.5; the project has been archived as of July 2026.

## Affected products

- Peppermint Lab Peppermint through 0.5.5

## Timeline

- 2026-09-03: disclosed

## References

- [https://github.com/Peppermint-Lab/peppermint](https://github.com/Peppermint-Lab/peppermint)
- [https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/auth.ts](https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/auth.ts)

## Related threats

- [Peppermint missing authorization in time entries and attachments](https://junglewise.ai/threats/cve-2026-111353-peppermint-through-0-5-5-contains-a-missing-authorization)
- [Peppermint hardcoded JWT signing secret in docker-compose.yml](https://junglewise.ai/threats/cve-2026-85391-peppermint-hardcoded-jwt-signing-secret-in-docker-compose-yml)
- [Peppermint Lab Peppermint broken access control in OIDC configuration](https://junglewise.ai/threats/cve-2026-72561-peppermint-lab-peppermint-broken-access-control-in-oidc)
- [Peppermint Lab Peppermint broken access control in role checks](https://junglewise.ai/threats/cve-2026-72555-peppermint-lab-peppermint-broken-access-control-in-role-checks)