CyberRota Analysis
AI-GeneratedAn authorization bypass vulnerability exists in the logout endpoint of Peppermint versions up to 0.5.5, allowing authenticated attackers to terminate sessions for any user, including administrators, by providing arbitrary user IDs. This flaw poses a risk of session hijacking and unauthorized access, potentially disrupting user activities and administrative functions. Organizations using affected versions should prioritize patching this vulnerability to protect against unauthorized session management.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to delete sessions for any user by supplying arbitrary user IDs. Attackers can forcibly log out any user including administrators by calling the logout handler with another user's ID, since the endpoint performs no authorization checks to verify the caller owns the target account.