What is CVE-2026-72555?
A broken access control vulnerability exists in Peppermint Lab Peppermint. Due to the Config.roles_active flag defaulting to false, all permission checks on ticket, client, and user handlers become no-ops. This allows any authenticated user to bypass access controls on default installations.
Azərbaycanca: Peppermint Lab Peppermint proqramında pozulmuş giriş nəzarəti zəifliyi aşkarlanıb. Config.roles_active bayrağının default olaraq false olması səbəbindən bütün icazə yoxlamaları deaktiv qalır. Bu, autentifikasiya olunmuş istənilən istifadəçiyə ticket, müştəri və istifadəçi məlumatlarına icazəsiz giriş imkanı verir.
Related CVEs
link basis: same weakness class CWE-862
FAQ1
Why does the CVE-2026-72555 vulnerability occur in Peppermint Lab Peppermint?
This vulnerability occurs because the Config.roles_active flag defaults to false, which makes all permission checks on ticket, client, and user handlers become no-ops. As a result, any authenticated user can bypass access controls on default installations.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.