CVE-2026-71862

Checkmate's showURL vulnerability exposes a critical architectural failure: the developers treated the frontend React component as the security boundary, but the API layer returned unfiltered data regardless of what the UI chose to render. When visitors access /api/v1/status-page/:url, the server returns complete monitor objects including the Authorization credential used by HttpProvider — the actual secret authorizing access to your monitored infrastructure, not just the status page. The UI hiding this field meant nothing to an attacker making a simple GET request and inspecting the JSON response. This is not a configuration mistake. It's a data handling failure where the backend serializes full objects without field-level filtering based on client context. The fix being server-side field filtering confirms this: the vulnerability lived in the API response construction, not the UI layer. The CVSS 7.5 score undersells the real risk. The Low Attack Complexity reflects that no authentication is needed beyond enabling showURL, but the High Confidentiality impact is accurate only if you consider the credentials themselves — and stops short. Those HttpProvider secrets authorize access to your actual monitored infrastructure: cloud provider API keys, monitoring service tokens, or whatever authentication scheme HttpProvider uses. An attacker extracting these credentials has moved from passive status-page visitor to credentialed actor with potential write access to your infrastructure. One request can expose dozens of credentials if the status page aggregates multiple monitors. The exposure window spans versions 3.3.0 through 3.9.2 — four minor releases across an unknown timeframe. There's no evidence of pre-discovery exploitation, but the bug existed silently in production deployments. Check whether your Checkmate instance has showURL enabled. If it does, treat any HttpProvider credentials as compromised and rotate them immediately, regardless of whether the UI ever displayed them. The risk isn't what users saw — it's what the API returned to anyone who asked.

Reviewed through automated stages and approved by a human before publication.