Checkmate versions through 3.11.0 contain a missing authorization vulnerability where the isAllowed role guard middleware is omitted on maintenance-window, notification, and check-deletion routes. This flaw allows read-only users with standard user-role sessions to perform administrative actions without proper privilege checks. Attackers can exploit this to create arbitrary maintenance windows that silence monitoring alerts, modify notification channels, and delete monitor check history to erase evidence of incidents. The vulnerability affects three distinct route files: checkRoutes.ts, maintenanceWindowRoutes.ts, and notificationRoutes.ts. The issue has been reported via GitHub issue #3916 and documented by VulnCheck. The impact is significant as it allows tampering with monitoring integrity and incident response capabilities.
