Broken Access Control in Peppermint Lab Platform Affects User Security
CVE-2026-72561

8.8HIGH

Key Information:

Vendor

Peppermint Lab

Status
Peppermint
Vendor
CVE Published:
11 August 2026

What is CVE-2026-72561?

An access control vulnerability exists in the Peppermint platform, allowing any authenticated non-administrative user to circumvent security measures. This flaw permits unauthorized modifications to the global OIDC/SSO settings through an unsecured configuration endpoint. Without proper checks on administrative roles, an attacker can redirect SSO logins to a malicious identity provider, posing a significant risk of credential harvesting across users on the affected platform.

Affected Version(s)

Peppermint 0

References

https://github.com/Peppermint-Lab/peppermint

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bobur Abdugafforov
.