CVE-2026-72561 Peppermint Lab CVE debrief

Who should care

Administrators and users of Peppermint Lab Peppermint, especially those with authenticated non-administrative access, should be aware of this vulnerability. Operators managing Peppermint deployments, platform security teams, and vulnerability management teams need to assess their exposure and plan for remediation. Security teams responsible for monitoring and incident response should also be informed to prepare for potential credential harvesting attempts.

Technical summary

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before applying new OIDC issuer settings. This enables an attacker to potentially redirect all SSO logins to an attacker-controlled identity provider, facilitating credential harvesting for all platform users. The vulnerability highlights the importance of securing configuration endpoints and ensuring proper role-based access controls.

Defensive priority

Authenticated non-administrative users can reconfigure global OIDC/SSO settings, enabling potential credential harvesting. Urgent review and remediation recommended.

Recommended defensive actions

• Review and remediate the unprotected configuration endpoint
• Restrict access to OIDC/SSO settings to administrative roles
• Monitor for potential credential harvesting attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the broken access control vulnerability in Peppermint Lab Peppermint. Limited additional context available. To verify, defenders should review the official CVE Program record and NIST NVD detail page for source-provided CVE metadata and vulnerability assessment. The affected product scope appears limited to Peppermint Lab Peppermint through a specific commit (ba6e217). However, without further information, the full extent of potentially affected deployments and configurations remains unclear. Additional review of system logs and configurations may be necessary to confirm exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.