Authorization Bypass in Checkmate via Missing Role Guard Middleware

Checkmate through version 3.11.0 contains an authorization bypass vulnerability (CVE-2026-85390) originating from the omission of the 'isAllowed' role guard middleware on specific administrative API routes. These affected routes include maintenance-window management, notification channel configurations, and monitor check deletion endpoints. The flaw effectively grants authenticated users with read-only privileges the ability to perform high-privilege administrative operations. By exploiting this gap in access control, an attacker can manipulate system-wide monitoring configurations, silence critical alerts by creating arbitrary maintenance windows, or modify notification delivery to suppress security event awareness. Furthermore, the ability to delete check history permits the removal of incident evidence, potentially impeding forensic investigations and post-incident response activities within affected environments.

Impact

Successful exploitation allows read-only users to escalate their functional permissions, leading to potential loss of monitoring integrity and unauthorized removal of historical security telemetry. Organizations relying on Checkmate for infrastructure monitoring may face critical alert suppression and loss of audit trails, allowing other malicious activity to go undetected.

Recommendation

1. Upgrade Checkmate to version 3.11.1 or later immediately to patch CVE-2026-85390.
2. Perform an audit of administrative activity logs, specifically targeting successful calls to maintenance-window, notification-update, or check-deletion endpoints by accounts lacking the 'Administrator' role.
3. Review audit logs for atypical monitor check deletion activity occurring from read-only service accounts or user sessions.