Peppermint Lab Peppermint
3 CVEs affecting Peppermint Lab Peppermint. Latest disclosed: 2026-09-03. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-85391 | Critical | 9.8 | 2026-09-03 | Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any ac… |
CVE-2026-72561 | High | 8.8 | 2026-08-11 | A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the p… |
CVE-2026-72555 | High | 8.1 | 2026-08-11 | A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causin… |