CVE-2026-85390

Checkmate through version 3.11.0 (CWE-862, missing authorization) omits the isAllowed role-guard middleware on its maintenance-window, notification, and check-deletion API routes. Any authenticated user holding a read-only role session can therefore call these administrative endpoints over the network without elevated privileges. By exploiting the flaw, a low-privilege user can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history to erase evidence of past incidents, affecting integrity and availability of monitoring data rather than confidentiality. Only self-hosted Checkmate deployments at version 3.11.0 or earlier that have provisioned read-only user accounts are affected. There is no known public proof-of-concept, no CISA KEV listing, and a low 0.3% EPSS score, so exploitation is not currently observed or expected in the wild.

What to do: Upgrade Checkmate to a release newer than 3.11.0 that restores the isAllowed role-guard middleware on the maintenance-window, notification, and check-deletion routes. As an interim mitigation, audit which accounts hold read-only roles, restrict their session issuance, and review monitoring history and notification settings for unauthorized maintenance windows, channel changes, or deleted checks that may indicate abuse.