CVE-2026-71862

Name of the Vulnerable Software and Affected Versions Checkmate versions 3.3.0 through 3.9.1

Description Enabling the global showURL setting allows unauthenticated users to access the 'GET /api/v1/status-page/:url' endpoint. This endpoint returns complete monitor objects from the statusPageController.ts controller, which include the secret field used by HttpProvider.ts as an HTTP Authorization credential. Although the BaseStatusPage.tsx component does not display this value in the user interface, the credential remains present in the JSON response, allowing visitors to extract it and use it against monitored services.

Recommendations Update to version 3.9.2. Disable the showURL setting as a temporary mitigation measure.