Authorization Bypass Issue in Peppermint by Peppermint Lab

CVE-2026-85392

What is CVE-2026-85392?

An authorization bypass vulnerability in Peppermint allows authenticated users to exploit the GET /api/v1/auth/user/:id/logout endpoint, enabling them to delete any user's session, including that of administrators. The flaw arises from a lack of proper authorization checks on the endpoint, which permits attackers to force logout any user by simply providing an arbitrary user ID, thereby compromising user accounts and potentially affecting security across the platform.

References