This vulnerability arises because the Config.roles_active flag in Peppermint defaults to false, causing all permission checks related to tickets, clients, and user handlers to be no-ops. As a result, any authenticated user can bypass ownership and administrative access controls. This broken access control flaw allows unauthorized access and modification of data across accounts within the system.

An attacker with any authenticated user account can read, modify, or delete tickets, clients, and users belonging to other accounts. This compromises confidentiality and integrity of data but does not affect availability. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a fix is available, restrict user account creation and monitor for suspicious activity to reduce risk.