CVE-2026-111353 Peppermint-Lab CVE debrief

Who should care

Defenders responsible for systems using Peppermint version 0.5.5 or earlier should assess exposure and prioritize remediation. This includes IT security teams, system administrators, and developers working with Peppermint.

Why it matters

CVE-2026-111353 is a missing authorization vulnerability in Peppermint through version 0.5.5. This vulnerability allows any authenticated user to create time entries and attachments as other users, potentially leading to data tampering and unauthorized data access. Defenders should prioritize verifying and remediating this vulnerability in their systems, especially those using Peppermint version 0.5.5 or earlier.

• Authenticated users can create unauthorized time entries and attachments.
• Potential for data tampering and unauthorized data access.
• Increased risk of insider threats or compromised accounts being used for malicious activities.
• Need for verification of Peppermint version and application of patches or updates.

Technical summary

The vulnerability exists in the Peppermint application, specifically in versions up to and including 0.5.5. It allows any authenticated user to create time entries and attachments as other users by manipulating the user ID in the request body of POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single. This could lead to unauthorized data access or tampering. Defenders should prioritize verifying and remediating this vulnerability in their systems, especially those using Peppermint version 0.5.5 or earlier. This involves checking for and applying any available patches or updates from the vendor, and monitoring for suspicious activity.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in their systems, especially those using Peppermint version 0.5.5 or earlier. This involves checking for and applying any available patches or updates from the vendor.

Recommended defensive actions

• Verify the version of Peppermint being used and check if it is vulnerable (version 0.5.5 or earlier).
• Apply any available patches or updates from the vendor to remediate the vulnerability.
• Monitor for and restrict unauthorized POST requests to /api/v1/time/new and /api/v1/storage/ticket/:id/upload/single.
• Consider implementing additional authorization checks and logging to detect and prevent similar issues in the future.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The evidence for this vulnerability comes from the CVE Program record, the NVD vulnerability detail page, and several source references provided by [email protected], including GitHub code snippets and a HackMD document detailing the missing authorization issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.