EUVD-2026-70667
GHSA-8cvg-rxfw-4pf6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privileged authenticated network user can modify integrity-critical admin routes; no confidentiality impact; limited availability impact from alert suppression.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history to erase incident evidence.
AnalysisAI
Missing role-guard middleware on three API route groups in Checkmate through v3.11.0 allows any authenticated low-privilege user to perform administrative actions reserved for admins. Authenticated user-role accounts can create maintenance windows that silence monitoring alerts across all monitors, tamper with notification channel configurations, and delete monitor check history to destroy incident evidence. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires possession of a valid Checkmate user-role session (any registered account suffices - admin credentials are not needed) and network-level access to the Checkmate server's API port. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) reflects a network-reachable, low-complexity attack requiring only a low-privileged authenticated session - conditions easily met by any registered Checkmate user. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the first Checkmate release that applies the isAllowed middleware to all three affected route files (maintenanceWindowRoutes.ts, notificationRoutes.ts, checkRoutes.ts); no specific patched version number is confirmed in the available advisory data, so the current HEAD of https://github.com/bluewave-labs/Checkmate should be checked directly for a fix commit or tagged release resolving issue #3916. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Checkmate deployments running v3.11.0 or earlier and review user role assignments to identify potential exposure; immediately implement network-layer access controls restricting administrative API endpoints to admin-only sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Checkmate versions prior to 3.4.0 allow unauthenticated attackers to retrieve unpublished status pages and internal moni
A mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate th
Remote memory exhaustion in Bluewave Labs Checkmate prior to version 3.9.1 allows unauthenticated network attackers to c
Credential leakage in Bluewave Labs Checkmate versions 3.3.0 through 3.9.1 exposes HTTP Authorization secrets to unauthe
User enumeration via observable response discrepancy in Checkmate through version 2.1.0 exposes whether any given email
ReDoS (catastrophic regex backtracking) in Checkmate monitoring platform versions 3.5.1 through 3.9.1 allows an authenti
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today