THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-85390 (HIGH 7.1) — Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence ale

[NVD] CVE-2026-85390 (HIGH 7.1) — Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence ale

mednvdPublished 2026-09-03

CVE-2026-85390 CVSS: 7.1 HIGH Published: 2026-09-03T19:17:30.690

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor

Indicators of compromise

CVE-2026-85390cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-85390