CVE-2026-111353: Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or /api/v1/storage/ticket/:id/upload/single to attach files and time records to any ticket under another user's identity.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Peppermint user can exploit it. The attacker needs the ability to send POST requests to the affected API endpoints and supply another user's ID in the request body.
What actions can an attacker perform?
An attacker can create time entries or upload attachments to tickets while attributing those actions to another user. The affected endpoints are /api/v1/time/new and /api/v1/storage/ticket/:id/upload/single.
How can I check whether my deployment is affected?
Deployments running Peppermint through version 0.5.5 are affected. Review time-entry and attachment-upload requests and records for actions attributed to users who did not perform them, particularly requests containing a user ID supplied by the client.