CVE-2026-85390: Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes
Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history to erase incident evidence.
Affected Software
Event History
Frequently Asked Questions
Which users are realistically able to exploit this issue?
Any authenticated user with a read-only user-role session can exploit the affected routes. No additional privileges or user interaction are required.
What actions could an attacker take through the missing authorization checks?
A read-only user can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history. These actions can suppress monitoring signals and remove incident evidence.
Are deployments running the default role model affected?
Deployments are affected if they have users assigned the read-only user role and expose the affected maintenance-window, notification, or check-deletion routes. The issue is caused by missing isAllowed role-guard middleware on those routes.
What can be done if an update is not immediately available?
Restrict or disable access to the affected maintenance-window, notification, and check-deletion routes for read-only users. Review role assignments and revoke or limit read-only sessions where practical.
How can administrators check for possible abuse?
Review maintenance windows for unexpected entries, notification-channel changes, and deleted monitor check history associated with read-only user accounts. Investigate these changes because they may have been used to silence alerts or erase incident evidence.