CVE-2026-31836

{"id": "CVE-2026-31836", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31836", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-03-20T21:27:07.529949Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "bluewave-labs", "product": "Checkmate", "versions": [{"status": "affected", "version": "<= 3.5.1"}]}]}], "published": "2026-03-20T18:16:13.540", "references": [{"url": "https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-6368-x7wr-wpm2", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. In versions from 3.5.1 and prior, a mass assignment vulnerability in Checkmate's user profile update endpoint allows any authenticated user to escalate their privileges to superadmin, bypassing all role-based access controls. An attacker can modify their user role to gain complete administrative access to the application, including the ability to view all users, modify critical configurations, and access sensitive system data. At time of publication, there are no publicly available patches."}, {"lang": "es", "value": "Checkmate es una herramienta de c\u00f3digo abierto y autoalojada dise\u00f1ada para rastrear y monitorear el hardware del servidor, el tiempo de actividad, los tiempos de respuesta y los incidentes en tiempo real con hermosas visualizaciones. En versiones desde la 3.5.1 y anteriores, una vulnerabilidad de asignaci\u00f3n masiva en el endpoint de actualizaci\u00f3n del perfil de usuario de Checkmate permite a cualquier usuario autenticado escalar sus privilegios a superadministrador, eludiendo todos los controles de acceso basados en roles. Un atacante puede modificar su rol de usuario para obtener acceso administrativo completo a la aplicaci\u00f3n, incluyendo la capacidad de ver a todos los usuarios, modificar configuraciones cr\u00edticas y acceder a datos sensibles del sistema. En el momento de la publicaci\u00f3n, no hay parches disponibles p\u00fablicamente."}], "lastModified": "2026-06-17T10:34:32.937", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bluewavelabs:checkmate:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7F58CAA-914A-4C3B-8E92-E137225D9620", "versionEndIncluding": "3.5.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}