CVE-2026-85392 Details

An authorization bypass vulnerability has been identified in Peppermint versions through 0.5.5. The issue resides in the GET /api/v1/auth/user/:id/logout endpoint, where authenticated users can delete sessions for any user by providing arbitrary user IDs. This vulnerability allows attackers to forcibly log out any user, including administrators, as the endpoint lacks authorization checks to verify ownership of the target account. User IDs can be easily obtained from the /api/v1/users/all endpoint, which is accessible to all authenticated users, or from JWT payloads and ticket responses.

To address this vulnerability, implement a check to ensure that the user ID in the request matches the ID of the authenticated user. Alternatively, require administrative privileges to log out other users.