A mass assignment flaw in Checkmate’s user profile update endpoint lets any authenticated user overwrite their role field and promote themselves to superadmin. The effect is a complete privilege escalation that allows viewing all users, changing critical system configurations, and accessing sensitive data. This vulnerability aligns with weaknesses that enable bypassing role‑based access controls.

The flaw affects the open‑source Checkmate monitoring tool from Bluewave Labs. Versions 3.5.1 and earlier are vulnerable; newer releases are not impacted. Only authenticated users with access to the application can exploit it.

The CVSS score of 8.1 categorizes it as high severity. The EPSS score is below 1%, indicating a low probability of widespread exploitation at present. Because it requires an authenticated user and there is no publicly available exploit, the current risk is moderate. Official remediation has not yet been released, so monitoring and stringent access control remain critical until a patch is applied.