CVE-2026-31836 is a high-severity mass assignment vulnerability affecting bluewavelabs Checkmate versions 3.5.1 and prior, allowing authenticated users to escalate their privileges to superadmin. Rated 8.1 CVSS, this flaw requires only low privileges and network access, enabling an attacker to gain complete administrative control, view all users, and modify critical configurations. This vulnerability has low attack complexity and requires no user interaction, leading to high impact on confidentiality and integrity. Currently, there are no publicly available exploits or patches, and it is not listed on the KEV catalog, though it has received minor community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.5.1CPE matchmatch criteria | cpe:2.3:a:bluewavelabs:checkmate:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.