Is there a patch available for CVE-2026-15227?

Yes, a patch is available for CVE-2026-15227. Update the affected software to the latest version immediately.

Checkmk CVE-2026-15227

Q: What is the CVSS score of CVE-2026-15227?

CVE-2026-15227 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

Q: Which versions of Checkmk are affected by CVE-2026-15227?

Checkmk's reporting module fails to enforce the 'Edit foreign Reports' permission, allowing any authenticated user - regardless of their assigned role - to modify reports belonging to other users.. A patch is available.

EUVD-2026-51529 MEDIUM

Missing Authorization (CWE-862)

2026-07-31 Checkmk

GHSA-m93w-q9x6-3m46

Authentication Bypass Checkmk Checkmk Gmbh

5.3

CVSS 4.0 · Vendor: Checkmk

Severity by source

Vendor (Checkmk) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable via web UI, low complexity, authenticated low-privilege user required; only report integrity affected, no confidentiality or availability loss, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Checkmk).

CVSS VectorVendor: Checkmk

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 13:20 vuln.today

Patch available

Jul 31, 2026 - 13:01 EUVD

DescriptionCVE.org

Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users.

AnalysisAI

Checkmk's reporting module fails to enforce the 'Edit foreign Reports' permission, allowing any authenticated user - regardless of their assigned role - to modify reports belonging to other users. Affected are all Checkmk deployments running versions prior to 2.5.0p10, 2.4.0p35, or 2.3.0p49, as well as the end-of-life 2.2.0 branch. No public exploit code or active exploitation has been identified at time of analysis, and real-world impact is bounded to report integrity rather than system compromise, but the permission bypass undermines multi-tenant trust boundaries in shared monitoring environments.

Technical ContextAI

Checkmk (by Checkmk GmbH, CPE: cpe:2.3:a:checkmk_gmbh:checkmk:*:*:*:*:*:*:*:*) is an enterprise IT infrastructure monitoring platform. The root cause is CWE-862 (Missing Authorization): the server-side handler for modifying reports does not verify that the requesting user holds the 'Edit foreign Reports' permission before acting on reports owned by a different account. This is a classic broken access control pattern - the permission exists in the role model but is not enforced at the business-logic layer for this specific operation. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms the flaw is reachable over the network with low complexity and requires only a valid authenticated session, with no attack-side prerequisites beyond standard HTTP access to the Checkmk web interface.

RemediationAI

Upgrade to Checkmk 2.5.0p10, 2.4.0p35, or 2.3.0p49 as appropriate for your branch; these are the confirmed fixed versions per the vendor's werk advisory at https://checkmk.com/werk/20003. Users on the end-of-life 2.2.0 branch must migrate to a supported release to receive the fix. As a compensating control prior to patching, administrators can restrict the Checkmk web interface to trusted network segments or authenticated VPN access, reducing the pool of users who can reach the vulnerable endpoint - though this does not eliminate the flaw for internal users. Auditing report ownership and reviewing recent report modification logs for unexpected changes is advisable on unpatched instances.