CVE-2026-72588

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history to erase incident evidence.

An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.

Checkmate from version 3.3.0 until 3.9.2, when the global showURL setting is enabled, causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects, including the secret field used as an HTTP Authorization credential, even though it is not displayed in the UI.

In Checkmate versions from 3.5.1 to 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression in the expectedValue field for advanced HTTP monitor matching. The expression is synchronously evaluated on the Node.js main event loop without a timeout or worker isolation, allowing catastrophic backtracking to freeze API endpoints, monitor checks, and WebSocket connections for all users. This issue is fixed in version 3.9.2.

Checkmate before version 3.9.1 has a memory exhaustion vulnerability in the public registration endpoint. An unauthenticated attacker can send multiple concurrent oversized files that are buffered before validation, leading to memory exhaustion and backend crash.