CVE-2026-72561

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72561", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "state": "PUBLISHED", "assignerShortName": "TuranSec", "dateReserved": "2026-08-10T10:32:49.082Z", "datePublished": "2026-08-11T11:12:48.863Z", "dateUpdated": "2026-08-11T12:18:54.557Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-11T11:12:48.863Z"}, "title": "Peppermint Lab Peppermint - Broken Access Control", "descriptions": [{"lang": "en", "value": "A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before applying new OIDC issuer settings. An attacker can redirect all SSO logins to an attacker-controlled identity provider, enabling credential harvesting for all platform users."}], "affected": [{"vendor": "Peppermint Lab", "product": "Peppermint", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "ba6e217", "versionType": "custom"}]}], "references": [{"url": "https://github.com/Peppermint-Lab/peppermint", "name": "Project Repository"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "value": "Bobur Abdugafforov", "type": "finder"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-11T12:18:33.808710Z", "id": "CVE-2026-72561", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T12:18:54.557Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72561", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T12:18:33.808710Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-11T12:18:37.468Z"}}], "cna": {"title": "Peppermint Lab Peppermint - Broken Access Control", "credits": [{"lang": "en", "type": "finder", "value": "Bobur Abdugafforov"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Peppermint Lab", "product": "Peppermint", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "ba6e217"}]}], "references": [{"url": "https://github.com/Peppermint-Lab/peppermint", "name": "Project Repository"}], "descriptions": [{"lang": "en", "value": "A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before applying new OIDC issuer settings. An attacker can redirect all SSO logins to an attacker-controlled identity provider, enabling credential harvesting for all platform users."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "shortName": "TuranSec", "dateUpdated": "2026-08-11T11:12:48.863Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72561", "state": "PUBLISHED", "dateUpdated": "2026-08-11T12:18:54.557Z", "dateReserved": "2026-08-10T10:32:49.082Z", "assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "datePublished": "2026-08-11T11:12:48.863Z", "assignerShortName": "TuranSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Peppermint", "vendor": "Peppermint Lab", "versions": [{"lessThanOrEqual": "ba6e217", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the platform global OIDC/SSO settings via an unprotected configuration endpoint. The endpoint performs no administrative role check before applying new OIDC issuer settings. An attacker can redirect all SSO logins to an attacker-controlled identity provider, enabling credential harvesting for all platform users."}, {"lang": "es", "value": "Una vulnerabilidad de control de acceso roto en Peppermint Lab Peppermint a trav\u00e9s del commit ba6e217 permite a cualquier usuario autenticado no administrativo reconfigurar la configuraci\u00f3n global de OIDC/SSO de la plataforma a trav\u00e9s de un endpoint de configuraci\u00f3n no protegido. El endpoint no realiza ninguna verificaci\u00f3n de rol administrativo antes de aplicar la nueva configuraci\u00f3n del emisor de OIDC. Un atacante puede redirigir todos los inicios de sesi\u00f3n de SSO a un proveedor de identidad controlado por el atacante, lo que permite la recolecci\u00f3n de credenciales para todos los usuarios de la plataforma."}], "id": "CVE-2026-72561", "lastModified": "2026-10-23T19:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72561", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-11T12:18:33.808710Z", "version": "2.0.3"}}]}, "published": "2026-08-11T12:17:42.073", "references": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "url": "https://github.com/Peppermint-Lab/peppermint"}], "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,ba6e217]"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "Peppermint", "source": "cna", "vendor": "Peppermint Lab"}, "product": "peppermint", "vendor": "peppermint"}], "created": "2026-08-11T17:00:11.479939+00:00", "updated": "2026-08-13T10:45:03.812860+00:00", "vendors": ["peppermint", "peppermint$PRODUCT$peppermint"]}