Checkmate
Monthly
User enumeration via observable response discrepancy in Checkmate through version 2.1.0 exposes whether any given email address is registered on the platform. The password recovery endpoint POST /api/v1/auth/recovery/request returns HTTP 200 for known accounts and a distinct status code for unknown ones, allowing unauthenticated remote attackers to silently map valid user accounts. No public exploit or CISA KEV listing exists at time of analysis, but exploitation requires no authentication and is trivially automatable.
A mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate their privileges to superadmin level, bypassing all role-based access controls. Checkmate versions 3.5.1 and prior are affected, an open-source self-hosted server monitoring tool from Bluewave Labs. Attackers can gain complete administrative access to view all users, modify critical configurations, and access sensitive system data, though no public patches are currently available.
Checkmate versions prior to 3.4.0 allow unauthenticated attackers to retrieve unpublished status pages and internal monitoring data through the GET /api/v1/status-page/:url endpoint due to missing authentication checks. Public exploit code exists for this information disclosure vulnerability, enabling remote attackers to access sensitive server hardware, uptime, and incident details without credentials. No patch is currently available for affected deployments.
User enumeration via observable response discrepancy in Checkmate through version 2.1.0 exposes whether any given email address is registered on the platform. The password recovery endpoint POST /api/v1/auth/recovery/request returns HTTP 200 for known accounts and a distinct status code for unknown ones, allowing unauthenticated remote attackers to silently map valid user accounts. No public exploit or CISA KEV listing exists at time of analysis, but exploitation requires no authentication and is trivially automatable.
A mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate their privileges to superadmin level, bypassing all role-based access controls. Checkmate versions 3.5.1 and prior are affected, an open-source self-hosted server monitoring tool from Bluewave Labs. Attackers can gain complete administrative access to view all users, modify critical configurations, and access sensitive system data, though no public patches are currently available.
Checkmate versions prior to 3.4.0 allow unauthenticated attackers to retrieve unpublished status pages and internal monitoring data through the GET /api/v1/status-page/:url endpoint due to missing authentication checks. Public exploit code exists for this information disclosure vulnerability, enabling remote attackers to access sensitive server hardware, uptime, and incident details without credentials. No patch is currently available for affected deployments.