What is the CVSS score of EUVD-2026-13744?

EUVD-2026-13744 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Checkmate are affected by EUVD-2026-13744?

A critical privilege escalation vulnerability in Checkmate server monitoring tool allows any authenticated user to gain superadmin access, potentially compromising all monitored infrastructure and…

How to fix or mitigate EUVD-2026-13744?

Within 24 hours: Inventory all Checkmate deployments and identify instances running versions 3.5.1 or earlier; restrict network access to the application to only essential personnel. Within 7 days: Implement network segmentation to isolate Checkmate instances; enable detailed audit logging for all user profile modifications; audit current user accounts for unauthorized privilege escalation. Within 30 days: Evaluate migration to an alternative monitoring solution or engage Bluewave Labs for a hotfix; establish a security review process for self-hosted tools with authentication mechanisms.

Checkmate EUVD-2026-13744

| CVE-2026-31836 HIGH

Improper Authorization (CWE-285)

2026-03-20 GitHub_M

Authentication Bypass Checkmate

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 18:00 euvd

EUVD-2026-13744

Analysis Generated

Mar 20, 2026 - 18:00 vuln.today

CVE Published

Mar 20, 2026 - 17:50 nvd

HIGH 8.1

DescriptionGitHub Advisory

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. In versions from 3.5.1 and prior, a mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate their privileges to superadmin, bypassing all role-based access controls. An attacker can modify their user role to gain complete administrative access to the application, including the ability to view all users, modify critical configurations, and access sensitive system data. At time of publication, there are no publicly available patches.

AnalysisAI

A mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate their privileges to superadmin level, bypassing all role-based access controls. Checkmate versions 3.5.1 and prior are affected, an open-source self-hosted server monitoring tool from Bluewave Labs. Attackers can gain complete administrative access to view all users, modify critical configurations, and access sensitive system data, though no public patches are currently available.

Technical ContextAI

The affected product is Bluewave Labs Checkmate (cpe:2.3:a:bluewave-labs:checkmate:*:*:*:*:*:*:*:*), a self-hosted server monitoring platform. The vulnerability stems from CWE-285 (Improper Authorization), specifically a mass assignment issue where the user profile update API endpoint fails to properly restrict which fields can be modified by authenticated users. Mass assignment occurs when applications automatically bind HTTP request parameters to program code variables or objects, allowing attackers to modify object properties that should be restricted. In this case, the endpoint likely accepts a role or privilege parameter without validating whether the requesting user should be allowed to modify their own authorization level.

RemediationAI

At the time of publication, no publicly available patches exist for this vulnerability, requiring immediate implementation of compensating controls. Organizations should restrict access to the Checkmate application to only trusted users and networks, implementing strict network segmentation and firewall rules to limit exposure. Monitor all user privilege modifications and user profile update API calls for suspicious activity, implementing alerting for any role changes. Consider temporarily disabling the user profile update endpoint or implementing application-layer firewalling (WAF) to block requests containing role or privilege parameters until an official patch becomes available. Regularly check the GitHub Security Advisory at https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-6368-x7wr-wpm2 for patch release announcements and apply updates immediately when available.