# CVE-2026-85390: Checkmate missing role guard middleware on maintenance and check routes

Source: https://junglewise.ai/threats/cve-2026-85390-checkmate-missing-role-guard-middleware-on-maintenance-and-check  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-85390 · Severity: high · CVSS 7.1 · Published 2026-09-03

Checkmate is an open-source server monitoring and uptime tracking tool. The application failed to enforce proper role-based access controls on certain administrative routes, allowing low-privilege users to create maintenance windows that silence alerts, modify notification settings, and delete monitoring check history. This enables attackers to cover up security incidents and disrupt monitoring alerting.

Technologies: [Bluewave-Labs Checkmate](https://junglewise.ai/threats/technologies/checkmate). Vendors: [Bluewave-Labs](https://junglewise.ai/threats/vendors/bluewave-labs).

## Quick answers

**Is CVE-2026-85390 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85390 being exploited in the wild.

**How severe is CVE-2026-85390?** High severity, with a CVSS score of 7.1, published 3 September 2026.

**Which products and versions are affected?** Bluewave-Labs Checkmate through 3.11.0.

**Is there a fix for CVE-2026-85390?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85390 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85390?** Check whether you run Bluewave-Labs Checkmate at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control (authorization bypass) in Checkmate through version 3.11.0. The affected routes (maintenance-window, notification, and check-deletion endpoints) are missing the isAllowed middleware that enforces role-based access control. While read-only and standard user-role sessions should be restricted from these administrative functions, the missing middleware allows any authenticated user to invoke them. Attackers with valid user-role credentials can create arbitrary maintenance windows to suppress alerts, modify notification channels, and delete check history to erase incident evidence. The vulnerability requires network access and valid authentication credentials. Fixes involve applying the isAllowed role guard middleware to the vulnerable routes.

## Affected products

- Bluewave Labs Checkmate through 3.11.0

## Timeline

- 2026-09-03: disclosed

## References

- [https://github.com/bluewave-labs/Checkmate](https://github.com/bluewave-labs/Checkmate)
- [https://github.com/bluewave-labs/Checkmate/blob/v3.11.0/server/src/api/routes/checkRoutes.ts](https://github.com/bluewave-labs/Checkmate/blob/v3.11.0/server/src/api/routes/checkRoutes.ts)

## Related threats

- [Bluewave Labs Checkmate privilege escalation in invite endpoint](https://junglewise.ai/threats/cve-2026-36102-bluewave-labs-checkmate-privilege-escalation-in-invite-endpoint)
- [Checkmate credential exposure in public status pages](https://junglewise.ai/threats/cve-2026-71862-checkmate-credential-exposure-in-public-status-pages)
- [Bluewave Labs Checkmate denial of service via unvalidated file upload](https://junglewise.ai/threats/cve-2026-55241-bluewave-labs-checkmate-denial-of-service-via-unvalidated-file)
- [Checkmate user enumeration via password recovery endpoint](https://junglewise.ai/threats/cve-2026-72588-checkmate-user-enumeration-via-password-recovery-endpoint)