Checkmate IDOR/Privilege Escalation: Low-priv User Role Can Modify Maintenance Windows, Status Pages, and Check History

Checkmate Vulnerability Summary Vulnerability Overview Title: User-role can create/modify/delete maintenance windows, status pages, notifications, and erase check history ID: #3916 Status: Open Type: Privilege Escalation (IDOR / Privilege Escalation) Root Cause: Checkmate applies the middleware on monitor CRUD and user-management routes, but the delete/create/modify endpoints for maintenance-window, status-page, notification, and check-history lack role checks, allowing the lowest-privilege user role to invoke these APIs. Impact The user role can: 1. Create a maintenance window of any duration, silencing all alerts; 2. Delete or overwrite public status pages; 3. Delete existing maintenance windows; 4. Create notification channels pointing to attacker-controlled endpoints; 5. Delete monitor check history, erasing incident evidence. In multi-user deployments, all team members are effectively granted administrative privileges, constituting a privilege escalation from "read-only observer" to "destructive operator." Remediation Consistently apply the middleware to the mutating routes (POST/PATCH/DELETE) for , , , and , aligning them with the monitor routes. Add role validation at the controller layer to avoid relying solely on middleware. POC Code Prerequisites: A Checkmate instance containing at least one admin/superadmin ( ) and one user account ( ). Verification: The user role invokes the above endpoints successfully, while monitor create/modify/delete operations are correctly blocked by , confirming that the inconsistency is limited to the four resource types listed above.

Goal Reached Thanks to every supporter — we hit 100%!

Checkmate IDOR/Privilege Escalation: Low-priv User Role Can Modify Maintenance Windows, Status Pages, and Check History

More from this source