Bluewave Checkmate CVE-2026-36102

Exploitation requires a valid authenticated administrator session within the target Checkmate deployment (PR:H per CVSS vector). The attacker must be able to reach the POST /api/v1/invite REST endpoint over the network (AV:N). No special non-default configuration is required beyond the presence of an admin account - the vulnerability exists in the default invite flow for any admin user. Limiting factors: an attacker without existing admin credentials cannot exploit this directly; the prerequisite admin access represents a meaningful barrier absent an insider threat or a separate credential-compromise vector.

The CVSS base score of 7.2 is technically correct given the PR:H requirement - an attacker must already hold administrator credentials before exploitation is possible, which substantially limits the attack surface compared to unauthenticated flaws. EPSS at 0.22% (12th percentile) aligns with this: the restricted prerequisite makes automated, opportunistic exploitation unlikely, and no CISA KEV listing indicates no confirmed in-the-wild exploitation at time of analysis. The real-world risk is therefore bounded: an organization is vulnerable only if an insider or compromised admin account is present, making this primarily an insider-threat or post-compromise escalation scenario. The published Gist and Outline blog post suggest a working proof of concept exists, which modestly elevates urgency for organizations using Checkmate with multiple admin-tier users. Given Checkmate's relatively niche deployment footprint, aggregate population exposure is low, though any single deployment granting multiple parties admin access should treat this as a meaningful lateral escalation path warranting prompt patching.

An authenticated administrator with a legitimate Checkmate account sends a crafted POST request to /api/v1/invite with the role field set to superadmin. The server's inviteController.js accepts the value without bounds-checking against the caller's own role tier, writing superadmin into the target account record. The attacker's account - or an invited account they control - now holds unrestricted superadmin access to the Checkmate instance. A public Gist by researcher Joren2087 documents this technique.