CVE-2026-31836

Katalog CVE

CVSS 8.1 · High EPSS 0,36%

Kerentanan Improper Privilege Management pada bluewavelabs checkmate. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. In versions from 3.5.1 and prior, a mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate their privileges to superadmin, bypassing all role-based access controls. An attacker can modify their user role to gain complete administrative access to the application, including the ability to view all users, modify critical configurations, and access sensitive system data. At time of publication, there are no publicly available patches.

Rincian

Terbit di NVD

20 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management
CWE-285: Improper Authorization

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 28,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-6368-x7wr-wpm2 exploit · advisory vendor