Checkmate Admin Action Bypass via Missing Role Guard

Executive Summary

Checkmate through version 3.11.0 lacks the isAllowed role guard middleware on specific routes: maintenance-window, notification, and check-deletion. This allows users with read-only privileges to perform administrative actions such as creating maintenance windows to silence alerts, modifying notification channels, and deleting monitor check history to remove incident evidence.

Useful 0 Not Useful 0

Detection Guidance

To detect CVE-2026-85390, inspect Checkmate API routes for missing isAllowed middleware on maintenance-window, notification, and check-deletion endpoints. Check if user-role accounts can access POST/PATCH/DELETE methods on /maintenance-window, /notification, or /check routes. Review server logs for unauthorized administrative actions by non-admin users.

Useful 0 Not Useful 0

Impact Analysis

Attackers with user-role sessions can exploit this to disrupt monitoring by creating unauthorized maintenance windows, altering notification settings to hide alerts, and deleting check history to erase evidence of incidents. This undermines system reliability and incident response capabilities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by allowing unauthorized users to delete monitoring data, including incident evidence. GDPR requires data integrity and accountability, while HIPAA mandates audit controls for protected health information. Unauthorized deletions may breach these requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update Checkmate to the latest version that includes the isAllowed role guard middleware on affected routes. Review user permissions to ensure read-only users cannot perform administrative actions. Monitor logs for unauthorized maintenance window creation, notification modifications, or check deletions.

Useful 0 Not Useful 0