Checkmate CVE-2026-31836

Requires authenticated access to Checkmate versions 3.5.1 and prior. Any authenticated user can exploit the mass assignment vulnerability in the user profile update endpoint to escalate privileges to superadmin without victim interaction. No special configuration required—vulnerability exists in default deployments.

This vulnerability presents a critical real-world risk despite the CVSS score of 8.1. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low complexity requiring only low-level privileges (any authenticated user), making it highly exploitable. The Authentication Bypass tag confirms the severity of authorization control failures. While no EPSS score or KEV status is provided in the data, the combination of low attack complexity, network accessibility, and privilege escalation to superadmin represents an extremely dangerous scenario for any organization using Checkmate. The lack of available patches at publication time significantly elevates urgency, as affected installations have no immediate vendor-supplied remediation path. This is a genuine high-priority issue requiring immediate attention, not a theoretical vulnerability.

An attacker with a low-privileged authenticated account (such as a basic monitoring user) intercepts the user profile update request and adds a role or privilege parameter set to superadmin or administrator. The vulnerable endpoint accepts this modification without proper authorization checks, immediately granting the attacker full administrative access to the Checkmate installation, allowing them to view all monitored servers, access sensitive configuration data, create backdoor accounts, and potentially pivot to monitored infrastructure.