Checkmate CVE-2026-72588

No special conditions are required for exploitation beyond network access to the Checkmate web application. The CVSS vector confirms unauthenticated (PR:N) network (AV:N) exploitation with low complexity (AC:L) and no user interaction (UI:N). The password recovery endpoint is intentionally public-facing. Exploitation is limited to information disclosure - specifically, confirming email address registration status - and does not grant authentication or data access. Exploitation is constrained only by rate-limiting controls if present, and is not platform- or configuration-specific.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N scores 5.3 (Medium), accurately reflecting the limited confidentiality impact - an attacker learns only account existence, not credentials or data. EPSS data was not provided in the intelligence package, limiting probabilistic exploitation forecasting. There is no CISA KEV listing and no confirmed public exploit code, placing exploitation status at the lowest risk tier. However, the attack complexity is genuinely low: the endpoint is network-accessible, requires no authentication, and the enumeration signal (HTTP 200 vs. other) is unambiguous and scriptable. Even a small deployment - say, a mid-sized municipal IT team in opole operating a self-hosted Checkmate instance - could have its full user email list harvested silently with a simple script, enabling targeted phishing campaigns as a follow-on. The primary real-world risk is account pre-targeting for credential stuffing or spear phishing, not direct system compromise. SSVC signals: exploitation status unproven, attack is automatable, technical impact is partial - overall a low-to-medium operational priority unless the Checkmate instance hosts sensitive infrastructure accounts.

An unauthenticated attacker sends automated POST requests to /api/v1/auth/recovery/request with a wordlist of candidate email addresses. By observing HTTP 200 versus non-200 responses, the attacker silently builds a list of valid registered accounts in minutes. That account list is then used as a target set for credential stuffing against the Checkmate login endpoint or for crafting convincing phishing emails.