Authorization Bypass Vulnerability in Checkmate by Bluewave Labs
CVE-2026-85390

7.1HIGH

Key Information:

Vendor

Bluewave-labs

Status
Checkmate
Vendor
CVE Published:
3 September 2026

What is CVE-2026-85390?

An authorization bypass has been discovered in Checkmate versions up to 3.11.0, where the isAllowed role guard middleware is not applied to essential routes, including maintenance-window, notification, and check-deletion. This oversight allows users with read-only permissions to conduct administrative actions, such as creating maintenance windows that can suppress alerts, altering notification channels, and erasing check history. Such capabilities can enable attackers to manipulate the system, hampering incident response and evidence tracking.

Affected Version(s)

Checkmate 0 <= 3.11.0

References

https://github.com/bluewave-labs/Checkmate/issues/3916
issue-tracking
https://github.com/bluewave-labs/Checkmate
product
https://github.com/bluewave-labs/Checkmate/blob/v3.11.0/s...
technical-description

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.