Description

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history to erase incident evidence.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-03T19:17:30.690Z",
  "pubdate": "2026-09-03T19:17:30.690Z",
  "executiveSummary": "Checkmate versions up to 3.11.0 are susceptible to an improper authorization vulnerability due to missing role guard middleware on sensitive administrative endpoints. This vulnerability permits authenticated users with limited read-only permissions to perform unauthorized administrative operations.\nThe core of the issue lies in the omission of 'isAllowed' role verification logic within the application's routing layer for maintenance-window, notification, and check-deletion modules. By circumventing these authorization checks, an attacker with a standard user-role session can manipulate system-level configurations and monitor states.\nThe risk implications are significant, as unauthorized parties can suppress critical system alerts by creating maintenance windows, alter notification channels to redirect or drop operational alerts, and perform unauthorized deletion of monitor check history. This enables the obfuscation of incident evidence and the disruption of monitoring integrity. Exploitation requires an active session, but does not necessitate elevated privileges, making it a severe flaw in the application's access control architecture. The lack of validation at the controller or route level facilitates direct interaction with privileged administrative functions by unauthorized subjects.",
  "technicalDetails": "The vulnerability originates from an Authorization Bypass via Missing Role Guard Middleware in the Checkmate application's routing architecture. In versions 3.11.0 and earlier, the application fails to enforce the 'isAllowed' role guard middleware on specific critical API routes: /maintenance-window, /notification, and routes associated with check-deletion.\nThe root cause is a failure in the application's middleware implementation pipeline. While the application utilizes 'isAllowed' as a security decorator or middleware intended to verify that the requesting user's role possesses sufficient permissions to execute administrative functions, this check is entirely absent from the identified pathways. Consequently, when an HTTP request is made to these administrative endpoints, the server only validates the existence of a session (authentication) rather than the privileges associated with that session (authorization).\nAn attacker can exploit this by intercepting requests or manually crafting HTTP requests to these endpoints. Since the server does not enforce secondary role-based access control, the request is processed by the application logic as if it originated from a privileged administrator. The attack flow involves: 1. Obtaining a valid session token through a standard, lower-privileged user account. 2. Sending POST, PUT, or DELETE requests to the unprotected /maintenance-window, /notification, or history deletion endpoints. 3. The server executes these requests, effectively modifying the application state.\nThe impact includes the ability for an attacker to silence monitoring alerts by injecting maintenance windows, which prevents incident response teams from being notified of system outages. By modifying notification channels, an attacker can hijack communication pathways, ensuring that alerts are routed to unauthorized locations or silenced entirely. Furthermore, the ability to delete monitor check history allows an attacker to clear logs, effectively purging forensic evidence of unauthorized access or system performance anomalies. The vulnerability is persistent and remains active as long as the underlying routing configuration is missing the 'isAllowed' middleware. This flaw effectively negates the distinction between 'admin' and 'read-only' roles for these specific components, representing a failure in the principle of least privilege."
}