Privilege Escalation in Checkmate via Role Parameter

Executive Summary

CVE-2026-36102 is a critical privilege escalation vulnerability in Bluewave Labs Checkmate versions 3.3.0 and earlier. It allows a remote authenticated administrator to escalate their privileges to superadmin by manipulating the role parameter in the /api/v1/invite endpoint. The flaw exists due to missing authorization checks, enabling an admin to create a superuser account and gain full system control.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API logs for suspicious POST requests to /api/v1/invite or /invite endpoints with role parameter manipulation. Check for unauthorized superadmin role assignments in user management logs. Review JWT tokens for admin accounts used to create new superuser accounts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated admin to escalate privileges to superadmin, gaining full system-wide control. Attackers could read or modify user data, perform system resets, and create new superuser accounts. The impact is significant as it compromises the entire Checkmate platform's security.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Checkmate to version 3.4.0 or later. Review and restrict admin permissions to prevent unauthorized role escalation. Audit all superadmin accounts created after the vulnerability's discovery date. Disable the V2 API if not required or enforce strict role checks.

Useful 0 Not Useful 0