CVE-2026-72555 Peppermint Lab CVE debrief

Who should care

Users and administrators of Peppermint Lab Peppermint installations, especially those with multi-user environments, should review and verify their deployments for exposure. Security teams and vulnerability management teams should prioritize assessment and remediation of potentially affected systems. Operators of affected platforms should consider implementing compensating controls and monitoring to limit potential impact until an update is available. Asset inventory and configuration management processes should be reviewed to identify and address potential vulnerabilities.

Technical summary

A broken access control vulnerability exists in Peppermint Lab Peppermint through commit ba6e217. The Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops. Authenticated users can bypass ownership and administrative access controls, allowing them to read, modify, or delete tickets, clients, and users belonging to any other account.

Defensive priority

Authenticated users can bypass access controls, read, modify or delete tickets, clients and users.

Recommended defensive actions

• Inventory and verify Peppermint Lab Peppermint installations for exposure.
• Restrict access to sensitive resources.
• Implement compensating controls to monitor and limit user actions.
• Update Peppermint Lab Peppermint to the latest version if available.
• Review configuration settings for Config.roles_active flag.
• Monitor user actions and system logs for suspicious activity.
• Verify access controls and ownership checks are enforced properly.

Evidence notes

The CVE-2026-72555 record indicates a broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217. The Config.roles_active flag defaults to false, causing permission checks to behave as no-ops. Authenticated users can bypass ownership and administrative access controls. Evidence is limited to public sources and may not reflect all affected deployments or variations. Defenders should verify Peppermint Lab Peppermint installations for exposure, review compensating controls, and monitor user actions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.