EUVD-2026-70667
GHSA-8cvg-rxfw-4pf6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain valid low-privilege Checkmate user session
-
DeliverySend POST to maintenance-window route
-
ExploitCreate window silencing all monitor alerts
-
InstallSend POST/PUT to notification routes
-
C2Tamper with alert notification channels
-
ExecuteSend DELETE to check-deletion route
-
ImpactErase incident check history to destroy evidence
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires possession of a valid Checkmate user-role session (any registered account suffices - admin credentials are not needed) and network-level access to the Checkmate server's API port. The isAllowed middleware is absent from the affected routes in the default Checkmate configuration through v3.11.0; no special non-default configuration is required to trigger the flaw. Exploitation is bounded by the authentication requirement: fully unauthenticated external attackers without any account cannot exploit this issue, but any insider, shared-account holder, or attacker who compromises even a read-only user credential can immediately invoke the affected administrative routes. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) reflects a network-reachable, low-complexity attack requiring only a low-privileged authenticated session - conditions easily met by any registered Checkmate user. The score of 7.1 is anchored to high integrity impact (VI:H) and low availability impact (VA:L), with no confidentiality impact, which aligns well with the described capability: an attacker can corrupt operational state (alert suppression, notification tampering) and destroy forensic evidence (check history deletion) but cannot exfiltrate data. The operational impact may significantly exceed the raw score in environments that depend on Checkmate for alerting - even a mid-sized municipal IT team in gniezno operating Checkmate as their primary uptime monitor should treat this as urgent, because an attacker who silences alerts and erases check history can conduct a concurrent intrusion with significantly reduced detection probability. No public exploit identified at time of analysis, and CISA KEV listing is absent; however, the exploitation path is trivially reproducible from the published GitHub issue and source code references, requiring no additional technical sophistication beyond valid credentials. |
| Exploit ScenarioDerived | An attacker with any valid Checkmate user-role account - such as a disgruntled employee or a user whose credentials were phished - sends a crafted POST request directly to the maintenance-window API endpoint without needing admin credentials, successfully creating a maintenance window covering all monitors and silencing all alerts. They then issue DELETE requests to the check-deletion routes to erase check history records from an ongoing incident, destroying forensic evidence and preventing operations teams from correlating the timeline of a concurrent breach. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Missing role-guard middleware on three API route groups in Checkmate through v3.11.0 allows any authenticated low-privilege user to perform administrative actions reserved for admins. Authenticated user-role accounts can create maintenance windows that silence monitoring alerts across all monitors, tamper with notification channel configurations, and delete monitor check history to destroy incident evidence. No public exploit identified at time of analysis, though the vulnerability is documented in a public GitHub issue and a VulnCheck advisory, making opportunistic exploitation by insiders or compromised accounts plausible without further development effort.
RemediationAI
Upgrade to the first Checkmate release that applies the isAllowed middleware to all three affected route files (maintenanceWindowRoutes.ts, notificationRoutes.ts, checkRoutes.ts); no specific patched version number is confirmed in the available advisory data, so the current HEAD of https://github.com/bluewave-labs/Checkmate should be checked directly for a fix commit or tagged release resolving issue #3916. As an immediate compensating control, restrict POST and DELETE HTTP methods on the /api/maintenance-window, /api/notifications, and /api/checks endpoints at the reverse proxy or firewall layer to admin-only source IP ranges, preventing non-admin users from reaching these routes network-side; note this requires proxy-level method filtering and does not address the underlying code defect. Additionally, audit existing user accounts to minimize the pool of valid low-privilege sessions, and review maintenance window and notification change logs for unauthorized entries made prior to remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Checkmate is an open-source uptime and infrastructure monitoring platform by Bluewave Labs (CPE: cpe:2.3:a:bluewave-labs:checkmate). Its server is built on Node.js/Express, and route-level middleware enforces role-based access control (RBAC) via an isAllowed guard function. CWE-862 (Missing Authorization) describes the root cause precisely: the isAllowed middleware is registered on some routes but was omitted entirely from three route definition files - maintenanceWindowRoutes.ts, notificationRoutes.ts, and checkRoutes.ts - all confirmed in the v3.11.0 tagged release on GitHub. Authentication is still enforced (sessions exist), but the authorization layer that distinguishes 'user' from 'admin' role capabilities is absent on these endpoints, allowing privilege boundary bypass without credential escalation.
Know when Checkmate gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Low-privileged authenticated network user can modify integrity-critical admin routes; no confidentiality impact; limited availability impact from alert suppression.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history to erase incident evidence.
Executive ViewAI
Checkmate monitoring platform versions through 3.11.0 contain a privilege escalation vulnerability that allows any authenticated user to perform administrative functions, including disabling alerts, modifying notification configurations, and destroying incident records. Organizations using affected versions face operational blind spots during potential security incidents and loss of audit trails needed for compliance and forensic investigation. Insider threats and compromised standard user accounts present immediate risk given the ease of exploitation.
No vendor-released patch identified at time of analysis. Implement immediate compensating controls: restrict administrative API endpoint access via network segmentation or API gateway rules to admin-only roles and IP ranges; configure Web Application Firewall rules to block maintenance window creation, notification channel changes, and history deletion from non-admin requests; enable detailed audit logging on all API calls with automated alerts for suspicious role escalation patterns; limit service account privileges to minimum required permissions and enforce step-up authentication for administrative operations; conduct weekly manual reviews of user permission assignments and administrator action logs for anomalies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Checkmate versions prior to 3.4.0 allow unauthenticated attackers to retrieve unpublished status pages and internal moni
A mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate th
Remote memory exhaustion in Bluewave Labs Checkmate prior to version 3.9.1 allows unauthenticated network attackers to c
Credential leakage in Bluewave Labs Checkmate versions 3.3.0 through 3.9.1 exposes HTTP Authorization secrets to unauthe
User enumeration via observable response discrepancy in Checkmate through version 2.1.0 exposes whether any given email
ReDoS (catastrophic regex backtracking) in Checkmate monitoring platform versions 3.5.1 through 3.9.1 allows an authenti
Exploit-DB