{"id":"CVE-2026-85390","title":"Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions","summary":"Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create a…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cwe":["CWE-862"],"published":"2026-09-03","updated":"2026-09-10","sourceUpdated":"2026-09-10T15:53:23.707","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85390","references":[{"url":"https://github.com/bluewave-labs/Checkmate","label":"disclosure@vulncheck.com"},{"url":"https://github.com/bluewave-labs/Checkmate/blob/v3.11.0/server/src/api/routes/checkRoutes.ts","label":"disclosure@vulncheck.com"},{"url":"https://github.com/bluewave-labs/Checkmate/blob/v3.11.0/server/src/api/routes/maintenanceWindowRoutes.ts","label":"disclosure@vulncheck.com"},{"url":"https://github.com/bluewave-labs/Checkmate/blob/v3.11.0/server/src/api/routes/notificationRoutes.ts","label":"disclosure@vulncheck.com"},{"url":"https://github.com/bluewave-labs/Checkmate/issues/3916","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/checkmate-through-3.11.0-missing-authorization-on-maintenance-window-notification-and-check-deletion-routes","label":"disclosure@vulncheck.com"},{"url":"https://github.com/bluewave-labs/Checkmate/issues/3916","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00269,"epssPercentile":0.19293,"ingestedAt":"2026-09-05T20:44:37.748Z","slug":"CVE-2026-85390","body":"## Overview\n\nCheckmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history to erase incident evidence.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}