EUVD-2026-46165
GHSA-h65g-fgc4-48g6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable BI API requires authenticated session (PR:L); no confidentiality or integrity scope change; availability not meaningfully impacted by BI rule tampering alone.
Primary rating from Vendor (Checkmk).
CVSS VectorVendor: Checkmk
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules
AnalysisAI
Improper permission enforcement in Checkmk's Business Intelligence (BI) module allows any authenticated low-privileged user to view and modify BI packs and rules regardless of their assigned permission set. Affected versions span four release branches - 2.5.0 through 2.5.0p8, 2.4.0 through 2.4.0p33, 2.3.0 through 2.3.0p48, and the end-of-life 2.2.0 branch - creating an access control bypass in a core monitoring configuration surface. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Checkmk (CPE: cpe:2.3:a:checkmk_gmbh:checkmk) is an enterprise IT infrastructure monitoring platform. Its Business Intelligence (BI) module allows operators to aggregate monitoring states into composite rules and packs, which represent logical service availability models. The root cause is CWE-862 (Missing Authorization): the application fails to enforce the permission checks that gate read and write access to BI configuration objects. Rather than an authentication bypass (the tag is somewhat misleading), this is a post-authentication authorization failure - the server accepts BI API or UI requests from sessions holding insufficient privilege levels without rejecting them. This class of flaw typically arises when authorization gates exist at the UI layer but are absent or inconsistently applied at the underlying API or backend handler level.
RemediationAI
The primary remediation is to upgrade to a patched release: Checkmk 2.5.0p9, 2.4.0p34, or 2.3.0p49, as confirmed by the vendor advisory at https://checkmk.com/werk/16918. Organizations running the EOL 2.2.0 branch should treat migration to a supported release as urgent, as no patch will be issued for that branch. As a compensating control where immediate patching is not possible, administrators should audit all existing Checkmk user accounts and remove or restrict accounts that do not require BI module access, reducing the pool of potential abusers. Additionally, Checkmk role-based access can be reviewed to ensure least-privilege principles are applied to all non-admin accounts. Note that role reconfiguration alone does not close the underlying authorization bypass - it only reduces exposure until the patch is applied.
Check_MK before 1.2.8p26 mishandles certain errors within the failed-login save feature because of a race condition, whi
The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dok
The web management console of CheckMK Enterprise Edition (versions 1.5.0 to 2.0.0p9) does not properly sanitise the uplo
Improper restriction of excessive authentication attempts on some authentication methods in Checkmk before 2.3.0b5 (beta
The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the W
Local privilege escalation in Checkmk allows site users with high privileges to escalate to root by manipulating site co
Bypass of two factor authentication in RestAPI in Checkmk < 2.3.0p16 and < 2.2.0p34 allows authenticated users to bypass
Insufficient authentication flow in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows attacker to use locked credent
A security vulnerability in autocomplete endpoint within the RestAPI of Checkmk (CVSS 8.8) that allows an authenticated
Privilege escalation in mk_tsm agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escal
Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user t
Cross-Site request forgery in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) could lead to 1-click com
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today