CVE-2026-85392

Name of the Vulnerable Software and Affected Versions Peppermint versions prior to 0.5.6

Description An authorization bypass exists in the 'GET /api/v1/auth/user/:id/logout' endpoint. Authenticated attackers can delete sessions for any user, including administrators, by providing arbitrary values for the :id variable. This occurs because the logout handler does not perform authorization checks to verify if the caller owns the target account.

Recommendations Update Peppermint to version 0.5.6 or later. As a temporary workaround, restrict access to the 'GET /api/v1/auth/user/:id/logout' endpoint to prevent unauthorized session termination.