Broken Access Control in Peppermint Lab Peppermint

Executive Summary

This is a broken access control vulnerability in Peppermint Lab Peppermint where the Config.roles_active flag defaults to false. This causes permission checks to fail, allowing all authenticated users to bypass ownership and administrative controls. Attackers with any account can read, modify, or delete tickets, clients, and users belonging to other accounts.

Useful 0 Not Useful 0

Detection Guidance

Check if the Config.roles_active flag is set to false in your Peppermint configuration. Inspect the application logs for unauthorized access attempts or actions performed by users without proper permissions. Verify if authenticated users can access or modify data belonging to other accounts.

Useful 0 Not Useful 0

Impact Analysis

If you use Peppermint Lab Peppermint with default settings, an attacker with any user account could access, alter, or delete your sensitive data including tickets, client information, and user accounts. This could lead to data breaches, unauthorized modifications, or complete system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to sensitive data. GDPR mandates strict access controls and data protection, while HIPAA requires safeguards to prevent unauthorized disclosure of protected health information. The flaw could result in regulatory penalties and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Set the Config.roles_active flag to true in your Peppermint configuration to enforce proper access controls. Review and restrict user permissions to ensure only authorized actions are permitted. Consider migrating to an actively maintained ticket management system as Peppermint is no longer supported.

Useful 0 Not Useful 0