The vulnerability in Checkmate through version 3.11.0 stems from an omission of the isAllowed role guard middleware on multiple routes. This missing authorization check allows users with read‑only roles to perform actions normally reserved for administrators, such as creating maintenance windows, modifying notification channels, and deleting monitoring check history records. The flaw aligns with CWE‑862, reflecting reliance on insufficient access control checks.

BlueWave Labs Checkmate is affected on all releases up to and including 3.11.0. Systems running these versions are at risk if read‑only user accounts are present in the application.

The CVSS base score of 7.1 indicates a medium to high severity vulnerability. No EPSS score is published, leaving the exact exploit probability uncertain. The vulnerability is not listed in the CISA KEV catalog, but it remains exploitable via normal authenticated sessions for users designated as read‑only. Attackers with such a session can send HTTP requests to maintenance‑window, notification, or check‑deletion endpoints to gain administrative privileges.