Vulnerability · Published Mar 7, 2026 · Assigned by GitHub_M
CVE-2026-30829Checkmate: Unauthenticated Access to Unpublished Status Page
Medium 5.3
In plain English
A medium-severity information exposure in Checkmate from bluewave-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Official description
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, an unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url endpoint. The endpoint does not enforce authentication or verify whether a status page is published before returning full status page details. As a result, unpublished status pages and their associated internal data are accessible to any unauthenticated user via direct API requests. This issue has been patched in version 3.4.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| bluewave-labs | Checkmate | < 3.4.0 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N