An authenticated administrator can maliciously set the role parameter on the /api/v1/invite endpoint, causing the system to grant superadmin privileges to the caller. This directly raises the attacker’s rights from any administrator role to a superadmin, enabling unrestricted access to all administrative functions, data, and system configuration with no further validation. The weakness is a classic example of improper access control, allowing an attacker to bypass intended permissions.

Bluewave Labs Checkmate software up to and including version 3.3.0 is affected. No version range beyond 3.3.0 is listed, so any installation of Checkmate 3.3.0 or earlier is at risk.

The exploit requires possession of administrative credentials to reach the /api/v1/invite endpoint; it does not require local access or elevated privileges on the host. It is inferred that an attacker could acquire such credentials via phishing, credential theft, or compromise of an existing admin account. The CVSS score of 7.2 classifies this vulnerability as high severity. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA KEV.