CVE-2026-111353

Received Received - Intake

Peppermint Auth Bypass Creates Fraudulent Time Entries

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111353

Affected Vendors & Products

Vendor	Product	Version / Range
Peppermint-Lab	peppermint	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Peppermint through version 0.5.5 has a missing authorization vulnerability. This flaw allows any authenticated user to create time entries and attachments for other users by including a user ID in the request body. Attackers can exploit this by sending POST requests to specific endpoints like /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.

Detection Guidance

Check HTTP request logs for POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single with a user ID parameter in the request body. Monitor for unauthorized time entries or file attachments linked to unexpected user accounts.

Impact Analysis

This vulnerability could allow unauthorized users to manipulate time entries and attachments, potentially leading to incorrect billing, fraudulent activity, or misattributed work. It may also enable attackers to frame other users for actions they did not perform, causing reputational damage or compliance issues.

Compliance Impact

This vulnerability could lead to violations of GDPR or HIPAA by enabling unauthorized data modifications or access. GDPR requires strict data integrity and access controls, while HIPAA mandates audit trails and protection of sensitive health information. Exploiting this flaw may result in unauthorized changes to records, compromising compliance.

Mitigation Strategies

Update Peppermint to the latest version beyond 0.5.5. Implement strict input validation to reject user ID parameters in POST requests. Restrict API endpoints to authorized roles only and review logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-111353. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70