Vulnpedia
← All CVEs

CVE-2026-31836

HIGH 8.1 ALL-YEARS

Published 2026-03-20 · Last modified 2026-03-20 · GitHub_M · NVD: Analyzed

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. In versions from 3.5.1 and prior, a mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate their privileges to superadmin, bypassing all role-based access controls. An attacker can modify their user role to gain complete administrative access to the application, including the ability to view all users, modify critical configurations, and access sensitive system data. At time of publication, there are no publicly available patches.

ELEVATED IMPACT

Severe if exploited (CVSS 8.1), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.3%chance of exploitation in 30 days · 23rd percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation poc, automatable no

Impact if exploited

8.1CVSS 3.1 · HIGH · CNA

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ⚠Privileges: Requires a low-privilege account
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Bluewave Labs Bluewavelabs

Products Checkmate

Weakness (CWE)

  • CWE-285: : Improper Authorization
  • CWE-269: : Improper Privilege Management

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References and research data (JSON)

Known Affected Software Configurations

VendorProductVersion range
BluewavelabsCheckmate≤ 3.5.1

All CVSS metrics

  • HIGH 8.1 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
  • HIGH 8.1 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Exploit-tagged references (not proof of a PoC)

Advisories

Sources: NVD · CVE.org · All sources and attribution · EPSS