Threat database

Peppermint versions up to 0.5.5 have a missing authorization vulnerability allowing any authenticated user to create time entries and attachments as other users by specifying a user ID in requests. This affects the POST endpoints /api/v1/time/new and /api/v1/storage/ticket/:id/upload/single, enabling unauthorized actions under another user's identity.

Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentials.