Checkmark Quick Setup Endpoint Authorization Bypass (CVE-2026-24986)

1. Vulnerability Overview: Title: Werk #18989: Enforce permission checks on Quick Setup endpoints Description: Prior to the fix, any authenticated user could interact with Quick Setup endpoints, allowing them to edit settings, retrieve backup job status, and execute quick setup operations. Root Cause: Due to the lack of proper permission checks in the API, users could modify page data and request quick setup execution by submitting crafted PUT and POST requests. Additionally, background job status could be read, leading to sensitive information disclosure. Discovery Source: This vulnerability was discovered during a commissioned penetration test conducted by PS Positive Security GmbH. CVSS Score: 5.3 Medium (CVSS:3.4/AV:N/AC:L/AT:N/PR:L/UI:N/S:U/C:L/I:L/A:L) CVE ID: CVE-2026-24986 2. Affected Versions: Affected Versions: 2.5.0, 2.4.0 Affected Versions List (from table): 2.4.0p26 (Checkmark Community, Checkmark Pro, Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Not yet released" 2.4.0p25 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p25" 2.4.0p24 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p24" 2.4.0p23 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p23" 2.4.0p22 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p22" 2.4.0p21 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p21" 2.4.0p20 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p20" 2.4.0p19 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p19" 2.4.0p18 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p18" 2.4.0p17 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p17" 2.4.0p16 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p16" 2.4.0p15 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p15" 2.4.0p14 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p14" 2.4.0p13 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p13" 2.4.0p12 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p12" 2.4.0p11 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p11" 2.4.0p10 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p10" 2.4.0p09 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p09" 2.4.0p08 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p08" 2.4.0p07 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p07" 2.4.0p06 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p06" 2.4.0p05 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p05" 2.4.0p04 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p04" 2.4.0p03 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p03" 2.4.0p02 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p02" 2.4.0p01 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0p01" 2.4.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.4.0" 2.3.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.3.0" 2.2.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.2.0" 2.1.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.1.0" 2.0.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 2.0.0" 1.9.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 1.9.0" 1.8.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 1.8.0" 1.7.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 1.7.0" 1.6.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 1.6.0" 1.5.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 1.5.0" 1.4.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 1.4.0" 1.3.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 1.3.0" 1.2.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 1.2.0" 1.1.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 1.1.0" 1.0.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 1.0.0" 0.9.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 0.9.0" 0.8.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 0.8.0" 0.7.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 0.7.0" 0.6.0 (Checkmark Ultimate, Checkmark Ultimate MT) - Marked as "Only released in 0.6.0" 0.5.0 (Checkmark Ul

Goal Reached Thanks to every supporter — we hit 100%!

Checkmark Quick Setup Endpoint Authorization Bypass (CVE-2026-24986)