Vulnerability · Published Sep 3, 2026 · Assigned by VulnCheck
CVE-2026-85392Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in peppermint from Peppermint-Lab. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Peppermint-Lab | peppermint | 0 – through 0.5.5 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- GitHub Issue #529 issue-tracking
- https://github.com/Peppermint-Lab/peppermint product
- https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/auth.ts technical-description
- VulnCheck Advisory: Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint third-party-advisory