CVE-2026-111353
Medium · CVSS 5.3Published 2026-10-15
CVSS
5.3
Medium
EPSS
—
exploit probability
Active Exploit
No
not yet listed
What is CVE-2026-111353?
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.
CVSS Score Explained
CVSS 5.3 is Medium severity. Exploitation usually requires some specific conditions (local access, user interaction, or a particular config). Still worth patching in your next maintenance window.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/storage.ts#L9-L35
- ›https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/controllers/time.ts#L6-L27
- ›https://github.com/Peppermint-Lab/peppermint/blob/0.5.5/apps/api/src/main.ts#L57-L70
- ›https://hackmd.io/@hieuPenguinnn/peppermint-data-logs-missing-authorization
- ›https://www.vulncheck.com/advisories/peppermint-through-0.5.5-missing-authorization-via-time-tracking-and-attachment-upload-endpoints
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-8311Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-5819Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-2937Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107316Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107172Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2025-3778Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—