CVE-2026-72555

Name of the Vulnerable Software and Affected Versions Peppermint Lab Peppermint versions through commit ba6e217

Description Broken access control occurs because the Config.roles active flag defaults to false, which causes permission checks on ticket, client, and user handlers to behave as no-ops (operations that have no effect) on default installations. Consequently, all authenticated users can bypass ownership and administrative access controls, allowing an attacker with any user account to read, modify, or delete tickets, clients, and users belonging to other accounts.

Recommendations Update Peppermint Lab Peppermint to a version beyond commit ba6e217. Enable the Config.roles active flag to ensure permission checks are active.