CVE-2026-36102: n/a

This vulnerability exists in the inviteController.js component of Bluewave Labs Checkmate versions up to and including 3.3.0. Remote authenticated administrators can exploit this flaw by sending a specially crafted request to the /api/v1/invite API endpoint, modifying the role parameter to escalate their privileges to superadmin. The CVSS v3.1 base score is 7.2, indicating a high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts to confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an authenticated administrator to gain superadmin privileges, potentially leading to full control over the affected system, including unauthorized access to sensitive data and administrative functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity related to the /api/v1/invite endpoint.