An authenticated administrator can maliciously set the role parameter on the /api/v1/invite endpoint, causing the system to grant superadmin privileges to the caller. This directly raises the attacker’s rights from any administrator role to a superadmin, enabling unrestricted access to all administrative functions, data, and system configuration with no further validation. The weakness is a classic example of improper access control, allowing an attacker to bypass intended permissions.

Bluewave Labs Checkmate software up to and including version 3.3.0 is affected. No version range beyond 3.3.0 is listed, so any installation of Checkmate 3.3.0 or earlier is at risk.

The exploit requires possession of administrative credentials to reach the /api/v1/invite endpoint; it does not require local access or elevated privileges on the host. While the EPSS score is not available and the vulnerability is not listed in CISA KEV, the nature of the flaw—escalation to superadmin—manifests a high impact if an attacker gains an administrator account. The attack is likely to be delivered by a compromised administrator account or through phishing/credential theft targeting those accounts.