What’s Vulnerable › Vulnerabilities

CVE-2026-72561: Peppermint Lab Peppermint - Broken Access Control

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-10-23
• Weakness: CWE-284

Description

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before applying new OIDC issuer settings. An attacker can redirect all SSO logins to an attacker-controlled identity provider, enabling credential harvesting for all platform users.

Affected products

• Peppermint Lab Peppermint: through ba6e217

References

• https://github.com/Peppermint-Lab/peppermint

Get alerted when CVE-2026-72561 or the next vulnerability affects your stack