Checkmk EUVD-2026-46165

Exploitation requires an active authenticated session on a Checkmk instance (PR:L confirmed by CVSS vector). The targeted feature is specifically the BI (Business Intelligence) module - if BI is not configured or in use within the deployment, the practical impact is reduced but the authorization flaw remains present. No special network positioning is required beyond reaching the Checkmk web interface (AV:N). Exploitation is limited by: (1) mandatory authentication - unauthenticated attackers cannot exploit this; (2) impact is scoped to BI pack and rule configuration only, not broader Checkmk system configuration or host monitoring data; (3) version 2.2.0 EOL deployments remain permanently exposed without vendor-provided remediation.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:L/VI:L/VA:L) scores 5.3 (Medium), which is a reasonable reflection of the realistic risk profile. The low-privilege requirement (PR:L) is the primary limiting factor: an attacker must already hold a valid Checkmk account, substantially narrowing the exploitable population to internal users and compromised credentials. Attack complexity is low and no special attack conditions are required. EPSS data is not provided in the available intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed widespread or targeted exploitation. The integrity impact is the more consequential signal here - unauthorized modification of BI packs and rules could silently distort availability dashboards and alerting logic, potentially masking genuine outages from operations teams. This elevates the real-world business risk above what the raw CVSS score alone suggests in monitoring-critical environments. No conflicting signals are present; available data is internally consistent.

An authenticated Checkmk user - for example, a read-only operator or a service account with minimal permissions - navigates directly to the BI module via the web UI or API without the required BI configuration permissions. Due to the missing server-side authorization check, the request is processed normally, granting the user full visibility into BI packs and the ability to alter BI rules, potentially reconfiguring availability aggregation logic to suppress alerts for critical services. No public exploit code has been identified at time of analysis.