CVE-2026-85392: Authorization Bypass Through User-Controlled Key in Peppermint-Lab peppermint

CVE-2026-85392 describes an authorization bypass vulnerability in Peppermint through version 0.5.5. The vulnerability exists in the GET /api/v1/auth/user/:id/logout endpoint, which allows authenticated users to delete sessions for any user by providing arbitrary user IDs. The endpoint does not perform authorization checks to confirm that the caller owns the target account, enabling attackers to forcibly log out other users, including administrators.

An attacker with authentication privileges can forcibly log out any user by invoking the logout endpoint with that user's ID. This could disrupt user sessions, potentially causing denial of service to legitimate users, including administrators. There is no indication of privilege escalation or data disclosure beyond session termination.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the logout endpoint to only allow users to log out their own sessions, or implement proper authorization checks verifying user identity before processing logout requests.