CVE Catalog
CVE-2026-36102
UnknownSummary
An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.
Risk Assessment
An authenticated administrator can gain highest privileges, potentially leading to full system control and data integrity compromise.
Recommendation
Update Checkmate to a patched version. Restrict role changes to appropriate permissions and validate input parameters.
Original NVD description (English source)
An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.