CVE-2026-36102

Bluewave Labs Checkmate, an open-source self-hosted uptime and infrastructure monitoring tool, mishandles role assignment in the inviteController.js component (CWE-269, improper privilege management). An authenticated administrator can call the /api/v1/invite endpoint and set the role parameter to a superadmin value, granting superadmin privileges to an invited or existing account. Because the attack already requires administrator credentials (CVSS 3.1 vector PR:H, score 7.2 high), the gain is elevation from admin to superadmin - full control over users, settings and monitoring data of the instance - rather than initial access. All Checkmate deployments running version 3.3.0 or earlier are affected. No public proof-of-concept or in-the-wild exploitation is known; EPSS puts the 30-day exploitation probability at 0.4% (33rd percentile) and the issue is not in CISA KEV.

What to do: Upgrade Checkmate to a release newer than 3.3.0 as soon as a patched version is published (the advisory data does not name a fixed version); as interim mitigation, restrict access to /api/v1/invite or validate the role parameter server-side. Administrators should audit invited accounts and anyone currently holding superadmin for unexpected grants, since any admin could have silently promoted an account. Limit the number of admin accounts, as the flaw only matters where admin credentials are already compromised or admins are not fully trusted.