CVE-2024-31525

Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control

High · published March 5, 2025

CVSS v3.1
7.2
EPSS
0%
Percentile
33.5
In the wild
Unconfirmed
What it is

Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain complete access to the system as the authorization mechanism is not validated on the server side and only on the client side. This can result, for example, in creating a new admin user in the system which enables persistent access for the attacker as an administrator.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00404 · 33.5th percentile
Published
2025-03-05T00:00Z
EPSS history
Timeline
  • 05 MAR 00:00Z
    Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control
    cvelistv5