A missing authorization check allows any authenticated user to submit time entries to come from another user. By including a target user ID in the POST payload to the time‑tracking or attachment upload endpoints, an attacker can create records and upload attachments under another user’s identity. This can lead to fraudulent billing, mistaken activity logging, or concealment of sensitive information, impacting the integrity and authenticity of project data.

The vulnerability affects Peppermint version 0.5.5 released by Peppermint‑Lab. No later versions are listed as vulnerable.

The CVSS score of 5.3 indicates a moderate risk. Because the injury can be caused only by authenticated users, the attack surface is limited to users who already have legitimate credentials. The EPSS score is < 1% and the issue is not listed in the CISA KEV catalog. Exploitation requires sending HTTP POST requests to `/api/v1/time/new` or `/api/v1/storage/ticket/:id/upload/single`, making it a network‑based attack that leverages typical API traffic. The lack of authorization logic means the vulnerability is straightforward to verify once credentials are obtained.