CVE-2026-85390: Missing Authorization in bluewave-labs Checkmate

Checkmate versions through 3.11.0 lack proper authorization checks on maintenance-window, notification, and check-deletion routes. The missing isAllowed role guard middleware permits users with read-only privileges to execute administrative functions such as creating arbitrary maintenance windows to silence alerts, modifying notification channels, and deleting monitor check history. This improper access control flaw elevates privileges for user-role sessions without requiring additional authentication or user interaction.

Attackers with user-role sessions can bypass intended access restrictions to perform administrative actions. This can lead to silencing alerts by creating maintenance windows, tampering with notification channels, and deleting monitor check history, potentially erasing evidence of incidents and hindering detection and response efforts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user-role permissions and monitor for unauthorized administrative actions on the affected routes.