CVE-2026-85390

Name of the Vulnerable Software and Affected Versions Checkmate versions prior to 3.11.1

Description Checkmate omits the isAllowed role guard middleware on the 'maintenance-window', 'notification', and 'check-deletion' routes. This flaw allows users with read-only permissions to perform administrative actions, such as creating arbitrary maintenance windows to silence alerts, modifying notification channels, and deleting monitor check history to remove evidence of incidents.

Recommendations Update Checkmate to version 3.11.1 or later. As a temporary mitigation, restrict access to the 'maintenance-window', 'notification', and 'check-deletion' routes to only trusted administrative users.