CVE-2026-72555: Peppermint Lab Auth Bypass Vulnerability

CVE-2026-72555 Overview

CVE-2026-72555 is a broken access control vulnerability [CWE-284] affecting Peppermint Lab Peppermint through commit ba6e217. The flaw stems from the Config.roles_active flag defaulting to false on new installations. This default causes permission checks across ticket, client, and user handlers to behave as no-ops. Any authenticated user can bypass ownership and administrative access controls to read, modify, or delete tickets, clients, and users belonging to other accounts.

Critical Impact
Any authenticated Peppermint user on a default installation can access and manipulate all tenant data, including tickets, clients, and user records belonging to other organizations.

Affected Products

Peppermint Lab Peppermint through commit ba6e217
Default installations where Config.roles_active is false
Self-hosted Peppermint helpdesk deployments

Discovery Timeline

2026-08-11 - CVE-2026-72555 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72555

Vulnerability Analysis

Peppermint is an open-source ticketing and helpdesk platform. The application relies on role-based access control (RBAC) logic gated behind a configuration flag named Config.roles_active. When this flag evaluates to false, the permission-check functions covering ticket, client, and user handlers short-circuit and permit the requested operation without evaluating ownership or role membership.

Because the flag defaults to false, every fresh installation ships with access control effectively disabled. Authenticated users retain the ability to authenticate normally, but authorization decisions are skipped entirely. The result is horizontal privilege escalation across tenants combined with vertical escalation into administrative operations.

An attacker who registers or acquires any user account can enumerate and mutate records that belong to unrelated accounts. This includes reading confidential ticket contents, altering client records, and deleting user entries. The vulnerability is exploitable over the network with low complexity and requires only low privileges.

Root Cause

The root cause is an insecure default configuration combined with a gating flag pattern. The Config.roles_active boolean gates all authorization checks. When set to false, handler-level permission verification returns without enforcing ownership or administrative role requirements, converting authorization logic into no-ops.

Attack Vector

An attacker authenticates to the Peppermint instance with any user account, including self-registered accounts where registration is enabled. The attacker then issues standard API requests against ticket, client, or user endpoints referencing object identifiers belonging to other accounts. Because Config.roles_active is false, the server processes the requests without ownership validation and returns or modifies the target data.

The vulnerability does not require crafted payloads, memory corruption, or specialized tooling. Standard HTTP clients targeting the documented API surface are sufficient. See the Peppermint GitHub repository for handler and configuration source references.

Detection Methods for CVE-2026-72555

Indicators of Compromise

Access log entries showing a single user account requesting ticket, client, or user object identifiers across a wide range of tenants or owners.
Unexpected PUT, PATCH, or DELETE requests against /api/v1/ticket, /api/v1/client, or /api/v1/user endpoints from non-administrative accounts.
Audit records indicating ticket reassignment, client edits, or user deletions performed by accounts that do not own the affected resources.

Detection Strategies

Inspect the running Peppermint configuration and alert if Config.roles_active evaluates to false.
Correlate authenticated session identifiers against the ownership metadata of requested resources and flag cross-owner access patterns.
Baseline per-user API request volume against ticket, client, and user endpoints and surface accounts exceeding normal access breadth.

Monitoring Recommendations

Forward Peppermint application logs and reverse-proxy access logs to a centralized logging platform for retention and analysis.
Monitor administrative operations, particularly user deletions and role modifications, for actions performed by non-administrator accounts.
Track configuration file changes to Config.roles_active and alert on values other than true in production environments.

How to Mitigate CVE-2026-72555

Immediate Actions Required

Set Config.roles_active to true on all Peppermint installations and restart the service to enforce role-based access controls.
Disable open user registration until the deployment is patched and access controls are verified.
Audit tickets, clients, and user records for unauthorized modifications or deletions performed since the installation date.

Patch Information

The vulnerability is present through commit ba6e217. Consult the Peppermint GitHub repository for the latest commits and any published fix that changes the default value of Config.roles_active or enforces authorization independent of the flag. Upgrade to a version that ships with access control enabled by default.

Workarounds

Manually enable Config.roles_active = true in the Peppermint configuration and validate that ticket, client, and user endpoints reject cross-owner requests from non-administrator accounts.
Restrict network exposure of the Peppermint instance to trusted networks or place it behind an authenticating reverse proxy until patched.
Rotate credentials for all Peppermint users after enabling role enforcement to invalidate sessions that may have been abused.

bash

# Configuration example - enable role enforcement in Peppermint
# Update the application configuration to explicitly enable RBAC
roles_active=true

# Restart the Peppermint service after applying the change
systemctl restart peppermint