CVE-2026-85390 — Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administra…
Published: 2026-09-03 · CVSS: 7.1 · CVSS 4.0
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history to erase incident evidence.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7