The vulnerability lies in the user logout route, where the server accepts a GET request to /api/v1/auth/user/:id/logout and deletes the target session without validating that the caller is the same user. An attacker who already has a valid session can therefore supply any user identifier, causing the targeted account to be logged out instantly. This can deny service to legitimate users, including administrators, and disrupt ongoing work. The flaw is a classic authorization bypass, cataloged as CWE‑639.

Affects the Peppermint project for all releases up to and including 0.5.5. The affected product is Peppermint from Peppermint‑Lab, and version 0.5.5 is explicitly vulnerable. Older or newer releases that do not contain the fix are not affected.

The CVSS score is 5.3, indicating a moderate severity. The EPSS value is not available, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation to date. Attackers need remote network access and a valid user session to trigger the flaw; the path is a simple authenticated HTTP call. Given the lack of active exploitation data, the risk is moderate but mitigable by updating the application or adding safeguards.