CVE-2026-30829: Checkmate: Unauthenticated Access to Unpublished Status Page
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, an unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url endpoint. The endpoint does not enforce authentication or verify whether a status page is published before returning full status page details. As a result, unpublished status pages and their associated internal data are accessible to any unauthenticated user via direct API requests. This issue has been patched in version 3.4.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30829?
CVE-2026-30829 is considered a medium severity vulnerability due to the risk of unauthenticated access to sensitive information.
How do I fix CVE-2026-30829?
To fix CVE-2026-30829, upgrade your Checkmate installation to version 3.4.0 or later.
Who is affected by CVE-2026-30829?
CVE-2026-30829 affects all users of Checkmate versions prior to 3.4.0.
What type of vulnerability is CVE-2026-30829?
CVE-2026-30829 is an unauthenticated information disclosure vulnerability.
Can CVE-2026-30829 lead to data leakage?
Yes, CVE-2026-30829 can potentially lead to data leakage by exposing unpublished status information.