PT-2026-23831 · Checkmate · Checkmate

Neo-Ai-Engineer + 1 · Published 2026-03-07 · Updated 2026-03-11 · CVE-2026-30829

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Checkmate versions prior to 3.4.0

Description An unauthenticated information disclosure issue exists in the GET /api/v1/status-page/:url endpoint. The endpoint does not enforce authentication or verify if a status page is published before revealing complete status page details. This allows any unauthenticated user to access unpublished status pages and their internal data through direct API requests. The vulnerable parameter is url.

Recommendations Update to version 3.4.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-30829

GHSA-57XF-WG6W-FJRR

Affected Products

Checkmate

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30829.json · Exploit
• https://github.com/bluewave-labs/Checkmate/security/advisories/GHSA-57xf-wg6w-fjrr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30829 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30829 · Security Note
• https://twitter.com/CVEnew/status/2030339344536670407 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2030199004353466481 · Twitter Post
• https://t.me/cveNotify/155152 · Telegram Post
• https://t.me/CVEtracker/46697 · Telegram Post