Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects from server/src/controllers/statusPageController.ts. The response includes the secret field used by HttpProvider.ts as an HTTP Authorization credential, even though BaseStatusPage.tsx does not display that value, allowing visitors to extract credentials from the JSON response and use them against monitored services. This issue is fixed in version 3.9.2.

CVE-2026-71862 affects Checkmate, an open-source self-hosted server monitoring tool, across versions 3.3.0 through 3.9.2. When the global showURL setting is enabled, the unauthenticated GET /api/v1/status-page/:url endpoint returns complete monitor objects including a secret field used as HTTP Authorization credentials. Although the frontend (BaseStatusPage.tsx) does not render this value, any visitor can extract the credentials directly from the raw JSON API response. These extracted credentials can then be used against the monitored services, posing a significant authentication bypass and credential exposure risk. The vulnerability exists in the statusPageController.ts and HttpProvider.ts components. No authentication is required to exploit this issue, making it easily exploitable by unauthenticated attackers. The issue has been patched in version 3.9.2 of Checkmate.