Incorrect Access Control in Peppermint Ticket Management by Peppermint Lab
CVE-2024-31525

7.2HIGH

Key Information:

Vendor

Peppermint Lab

Status
Peppermint Ticket Management
Vendor
CVE Published:
5 March 2025

What is CVE-2024-31525?

Peppermint Ticket Management version 0.4.6 has a vulnerability that allows registered users to elevate their privileges to that of an administrator. This flaw arises from a failure of the authorization mechanism, which is implemented only on the client side rather than being enforced on the server side. As a result, malicious users can exploit this misuse of access control to create new admin accounts, granting them persistent access to the system. Organizations using this software should take immediate action to mitigate the risk and protect their data.

References

https://cwe.mitre.org/data/definitions/285.html
https://github.com/Peppermint-Lab/peppermint/issues/258

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.