The vulnerability stems from the Config.roles_active setting defaulting to false. When this flag is false, permission checks for tickets, clients, and user management are effectively bypassed regardless of ownership or administrative privileges, allowing any authenticated user to read, modify, or delete data belonging to other accounts. This results in a loss of confidentiality and integrity across the application’s core data entities.

Peppermint Lab Peppermint on default installations, where the Config.roles_active flag is left at its default false value. No specific version restrictions are listed, implying the issue may exist in any release that has not applied the fix.

The CVSS score of 8.1 indicates high severity, yet the EPSS score is not available, so the current likelihood of exploitation is uncertain. The vulnerability is not listed in CISA KEV, but the nature of the access control flaw suggests it could be leveraged in targeted attacks once credentials are obtained. The attack vector appears to require authenticated access, meaning any user with a valid account can exploit the flaw without further privileges. Post-exploitation, an attacker can compromise all ticket, client, and user data maintained by the instance.