EUVD-2026-35051
GHSA-2x95-frx4-wh7r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid public dashboard share token
-
ExploitSend direct HTTP request to message-fetching API endpoint
-
ExecutionAuthorization resolves to dashboard creator identity
-
ImpactReceive dashboard creator's personal messages
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attack requires knowledge of a valid public dashboard share token (CVSS AT:P - Attack Requirements Present). The Checkmk deployment must have the public dashboard sharing feature enabled and at least one dashboard shared publicly via a share token. No authenticated session or user account is required (CVSS PR:N). The User Messages widget does not need to be present on the target dashboard - the message-fetching endpoint is callable directly. Limiting factors: the attacker's access is bounded to the dashboard creator's personal messages only (not arbitrary user data), and exploitation depends on obtaining a share token through some prior channel (link exposure, forwarding, etc.). |
| Impact | The CVSS 4.0 score of 6.3 reflects a network-reachable (AV:N), low-complexity (AC:L), no-privileges-required (PR:N), no-user-interaction (UI:N) attack, but with the Attack Requirements modifier set to Present (AT:P), acknowledging that a valid share token must be known. Impact is limited to partial confidentiality of the vulnerable component (VC:L) with no integrity or availability impact. There is no KEV listing and no public exploit identified, placing exploitation probability in the lower range. The real-world risk is meaningful but bounded: an attacker must first obtain a valid share token (e.g., via phishing, link-sharing exposure, or enumeration if tokens are predictable), and the data exposed is limited to the dashboard creator's personal messages rather than the broader user database. The EPSS signal is not available in the provided data. This vulnerability is a genuine priority for organizations using public dashboard sharing but does not represent a critical emergency for deployments that do not expose dashboards publicly. |
| Exploit ScenarioDerived | An attacker obtains a valid public dashboard share token - for example, from a link inadvertently posted in a public channel or shared via email and forwarded externally. They send a direct HTTP request to the Checkmk message-fetching API endpoint, supplying the share token as authorization, and receive the personal messages belonging to the user who created and shared the dashboard. No authentication account or elevated privileges are required beyond possession of the token. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Incorrect authorization in Checkmk's User Messages dashboard widget exposes the dashboard creator's personal messages to any party possessing a valid public dashboard share token. The message-fetching endpoints resolve messages using the dashboard creator's identity rather than the requesting party's identity, meaning that direct API calls with a share token return the issuer's private messages regardless of whether the User Messages widget is actually present on the shared dashboard. All Checkmk deployments running versions prior to 2.5.0p5 that use the public dashboard sharing feature are affected. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
RemediationAI
Upgrade Checkmk to version 2.5.0p5 or later, which is the vendor-confirmed patched release per advisory https://checkmk.com/werk/19815. If immediate upgrade is not feasible, the primary compensating control is to disable public dashboard sharing entirely within Checkmk's global settings, which removes the unauthenticated token-bearing access path and eliminates the attack surface; note that this will break any externally shared dashboard links currently in use. A more targeted workaround is to audit existing shared dashboards and revoke or regenerate share tokens for dashboards whose creators have sensitive messages, reducing exposure while maintaining sharing for lower-risk dashboards. Removing the User Messages widget from shared dashboards is insufficient as a workaround because the underlying endpoint is exploitable independently of widget presence.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Checkmk (CPE: cpe:2.3:a:checkmk_gmbh:checkmk) is an enterprise IT infrastructure monitoring platform. Its dashboard system supports public share tokens that allow unauthenticated viewers to access specific dashboards. The User Messages widget within those dashboards calls a backend message-fetching endpoint. The root cause, classified as CWE-863 (Incorrect Authorization), is that the endpoint resolves the message subject from the dashboard's creator context rather than the context of the token-bearing requester - an authorization logic flaw distinct from missing checks entirely. Because the vulnerable endpoint can be called directly with a share token independent of widget presence, the attack surface extends beyond dashboards that visually include the widget.
Know when Checkmk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (Checkmk) · only source for this CVE.
CVSS VectorVendor: Checkmk
Lifecycle Timeline
2DescriptionCVE.org
Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messages rather than the viewer's, allowing an attacker who knows a valid public dashboard share token to read the issuer's personal messages by sending requests to the underlying endpoint, even without a User Messages widget present.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, whi
The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dok
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uplo
Local privilege escalation in the Checkmk Windows Agent's Windows License plugin allows an authenticated low-privileged
Stored/transmitted cross-site scripting in Checkmk's distributed monitoring lets an attacker who already controls a remo
Authenticated path traversal in Checkmk's report scheduler lets a user with valid application credentials write report f
Improper restriction of excessive authentication attempts on some authentication methods in Checkmk before 2.3.0b5 (beta
The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the W
Local privilege escalation in Checkmk allows site users with high privileges to escalate to root by manipulating site co
Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass
Improper neutralization of active check command arguments in Checkmk < 2.1.0p32, < 2.0.0p38, < 2.2.0p4 leads to arbitrar
Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8
Exploit-DB