CVE-2026-30829

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, an unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url endpoint. The endpoint does not enforce authentication or verify whether a status page is published before returning full status page details. As a result, unpublished status pages and their associated internal data are accessible to any unauthenticated user via direct API requests. This issue has been patched in version 3.4.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-57xf-wg6w-fjrr	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:bluewavelabs:checkmate:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-07 06:16

Updated : 2026-03-11 18:56

NVD link : CVE-2026-30829

Mitre link : CVE-2026-30829

CVE.ORG link : CVE-2026-30829

JSON object : View

Products Affected

bluewavelabs

checkmate

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

{"id": "CVE-2026-30829", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2026-03-07T06:16:10.957", "references": [{"url": "https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-57xf-wg6w-fjrr", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, an unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url endpoint. The endpoint does not enforce authentication or verify whether a status page is published before returning full status page details. As a result, unpublished status pages and their associated internal data are accessible to any unauthenticated user via direct API requests. This issue has been patched in version 3.4.0."}, {"lang": "es", "value": "Checkmate es una herramienta de c\u00f3digo abierto y autoalojada dise\u00f1ada para rastrear y monitorear el hardware del servidor, el tiempo de actividad, los tiempos de respuesta y los incidentes en tiempo real con hermosas visualizaciones. Antes de la versi\u00f3n 3.4.0, existe una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n no autenticada en el endpoint GET /api/v1/status-page/:url. El endpoint no aplica autenticaci\u00f3n ni verifica si una p\u00e1gina de estado est\u00e1 publicada antes de devolver los detalles completos de la p\u00e1gina de estado. Como resultado, las p\u00e1ginas de estado no publicadas y sus datos internos asociados son accesibles para cualquier usuario no autenticado a trav\u00e9s de solicitudes directas a la API. Este problema ha sido parcheado en la versi\u00f3n 3.4.0."}], "lastModified": "2026-03-11T18:56:04.560", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bluewavelabs:checkmate:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47231DDC-8E2F-4BBA-95DA-C270F8DE9F14", "versionEndExcluding": "3.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}