An unauthenticated GET request to the /api/v1/status-page/:url endpoint exposes full status page information even if it has not been published. This lack of authentication and publication state verification represents a CWE-200 Information Exposure vulnerability. The endpoint omits authentication checks and does not verify publication state, allowing any user to retrieve internal hardware, uptime, response time, and incident details. This information disclosure can lead to compromised confidentiality of server infrastructure and operational insights.

The vulnerability affects the open‑source Checkmate tool provided by bluewave‑labs. All installations running any version older than 3.4.0 are susceptible, as the fix was introduced in that release.

The CVSS score of 5.3 reflects a moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers can simply issue an unauthenticated HTTP GET request to the vulnerable endpoint without needing special permissions, making the exploit straightforward.