CVE-2026-36102 Privilege escalation in n/a
Authenticated administrators can escalate privileges to superadmin by manipulating the role parameter in the invite endpoint.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-36102?
CVE-2026-36102 is a high-severity vulnerability in n/a, published on 27 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint.
Weakness: CWE-269
Which versions are affected by CVE-2026-36102?
How do I fix CVE-2026-36102?
No fix has been published for CVE-2026-36102 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-36102 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-36102 exists.
Sources
Also known as GHSA-3x65-v85x-f94h.