BlueWave Checkmate Privilege Escalation Vulnerability in Invite Request Handling

A vulnerability in BlueWave Checkmate versions through 2.0.2 prior to commit d4a6072 allows invite requests to be manipulated to assign privileged roles. This issue arises from improper handling of invitation tokens, enabling unauthorized users to gain elevated permissions during the registration process.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing users to gain access to roles with elevated permissions.

Reproduction

To reproduce this vulnerability, send an invite request and modify it to include a privileged role. Then, register using the invitation token, which will grant the specified elevated permissions.

Remediation

Users can update to BlueWave Checkmate version 2.1.1 or later, where this vulnerability has been addressed.