An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges… (CVE-2026-36102)
Description
A vulnerability in the inviteController.js component of Bluewave Labs Checkmate versions up to and including 3.3.0 allows remote authenticated administrators to escalate their privileges to superadmin by manipulating the role parameter on the /api/v1/invite endpoint.
CVSS v3.1
Score 7.2high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-36102 describes a privilege escalation vulnerability in Bluewave Labs Checkmate <=3.3.0. Remote authenticated administrators can exploit the inviteController.js component by sending a specially crafted request to the /api/v1/invite endpoint with a manipulated role parameter, enabling them to escalate their privileges to superadmin level.
Potential Impact
Successful exploitation grants an attacker with administrative access the ability to escalate to superadmin privileges, potentially leading to full system compromise with high confidentiality, integrity, and availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access and monitor for suspicious activity related to the /api/v1/invite endpoint.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3x65-v85x-f94h
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-36102"]
- State
- PUBLISHED
Threat ID: 6a91a872acd9273b49069c08
Added to database: 08/28/2026, 15:25:38 UTC
Last enriched: 09/08/2026, 04:37:19 UTC
Last updated: 10/13/2026, 06:48:16 UTC
Views: 52
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.