CVE-2026-36102: Bluewave Labs Checkmate privilege escalation in invite endpoint

CVE-2026-36102 · Severity: high · CVSS 7.2 · Published 2026-08-27

Checkmate is a platform for managing and monitoring infrastructure. A vulnerability in its user invitation system allows authenticated administrators to create new superuser accounts and thereby escalate their own privileges from admin to superadmin—the highest privilege level in the system. This grants access to all user accounts, sensitive data, and system-wide monitoring controls. An attacker with admin credentials could exploit this to establish persistent unauthorized control.

Technologies: Bluewave-Labs Checkmate. Vendors: Bluewave-Labs.

Quick answers

Is CVE-2026-36102 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-36102 being exploited in the wild.
How severe is CVE-2026-36102?
High severity, with a CVSS score of 7.2, published 27 August 2026.
Which products and versions are affected?
Bluewave-Labs Checkmate <=3.3.0.
Is there a fix for CVE-2026-36102?
A patch was published on 2026-02-04: Fix committed in PR 3240, released in version 3.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-36102 attacked?
It is attacked over the network.
Am I affected by CVE-2026-36102?
Check whether you run Bluewave-Labs Checkmate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-269, CWE-284, CWE-862) in the inviteController.js component of the POST /api/v1/invite endpoint. The vulnerable code lacks role hierarchy validation: an authenticated admin user can submit an invite token request with a role parameter set to "superadmin" without the application checking whether the requester's own role permits creation of higher-privileged accounts. The attack requires authentication (valid JWT token) and admin-level permissions. An attacker can abuse this to create a superuser account with arbitrary credentials, then use that account to gain full system access. The vulnerability is patched in version 3.4.0; affected versions are ≤3.3.0. The V2 API contains the same flaw but has not yet been patched.

Affected products

  • Bluewave Labs Checkmate <=3.3.0

Timeline

  • 2025-10-13: disclosed: Vulnerability initially reported
  • 2026-02-04: patched: Fix committed in PR 3240, released in version 3.4.0
  • 2026-08-27: advisory: CVE-2026-36102 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.