CVE-2026-72561
- EPSS 0.23%
- Veröffentlicht 11.08.2026 11:12:48
- Zuletzt bearbeitet 11.08.2026 13:19:03
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint pe...
CVE-2026-72555
- EPSS 0.26%
- Veröffentlicht 11.08.2026 11:11:27
- Zuletzt bearbeitet 11.08.2026 16:17:35
A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default...
CVE-2023-46863
- EPSS 0.85%
- Veröffentlicht 30.10.2023 00:15:39
- Zuletzt bearbeitet 21.11.2024 08:29:26
Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request.
CVE-2023-46864
- EPSS 0.66%
- Veröffentlicht 30.10.2023 00:15:39
- Zuletzt bearbeitet 21.11.2024 08:29:26
Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request.
CVE-2023-42328
- EPSS 1.16%
- Veröffentlicht 18.09.2023 16:15:45
- Zuletzt bearbeitet 21.11.2024 08:22:27
An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the hardcoded session cookie.
CVE-2023-26984
- EPSS 0.92%
- Veröffentlicht 29.03.2023 18:15:07
- Zuletzt bearbeitet 18.02.2025 17:15:16
An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the Tickets page via a crafted request.