CVE-2026-85392: Peppermint through 0.5.5 Authorization Bypass on the User Logout Endpoint
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Peppermint user can exploit it. The attacker only needs a valid account and an arbitrary target user's ID; administrators can be targeted as well.
What is the impact on affected users?
An attacker can delete the target user's sessions and forcibly log that user out. The provided information indicates an availability impact only; it does not describe disclosure or modification of data.
Are unauthenticated attackers affected by this vulnerability?
No. Exploitation requires the attacker to be authenticated.