CVE-2026-85390

An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.

Checkmate from version 3.3.0 until 3.9.2, when the global showURL setting is enabled, causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects, including the secret field used as an HTTP Authorization credential, even though it is not displayed in the UI.

In Checkmate versions from 3.5.1 to 3.9.2, an authenticated admin or superadmin can set matchMethod to regex and place a malicious expression in the expectedValue field for advanced HTTP monitor matching. The expression is synchronously evaluated on the Node.js main event loop without a timeout or worker isolation, allowing catastrophic backtracking to freeze API endpoints, monitor checks, and WebSocket connections for all users. This issue is fixed in version 3.9.2.

Checkmate before version 3.9.1 has a memory exhaustion vulnerability in the public registration endpoint. An unauthenticated attacker can send multiple concurrent oversized files that are buffered before validation, leading to memory exhaustion and backend crash.

A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request endpoint returns HTTP 200 for registered email addresses and a different status code for unregistered ones, enabling attackers to enumerate valid user accounts.