Checkmk EUVD-2026-51529

Exploitation requires a valid authenticated Checkmk session with at minimum a low-privilege account (PR:L confirmed by CVSS 4.0 vector). The attacker must not hold the 'Edit foreign Reports' permission - that is precisely the condition that should block the action but fails to do so. No special configuration, no non-default feature, and no specific platform variant is required beyond having access to a vulnerable Checkmk instance and knowledge of another user's report identifier. Exploitation is limited to integrity impact on reports; the flaw does not provide access to credentials, host data, or monitoring infrastructure configuration. Users without any valid Checkmk account cannot exploit this remotely.

The CVSS 4.0 score of 5.3 (Medium) is consistent with the actual risk profile. The vector confirms network reachability (AV:N) and low complexity (AC:L), but impact is strictly limited to low integrity on the vulnerable system (VI:L) with no confidentiality or availability consequence (VC:N/VA:N). No scope change affects downstream systems (SC:N/SI:N/SA:N). No CISA KEV listing exists, no public exploit or POC has been identified, and EPSS data is not provided - suggesting this has not attracted opportunistic attacker attention. The primary real-world concern is in multi-user or multi-team Checkmk deployments where report isolation between users is relied upon for data governance or operational separation. A single malicious or compromised low-privilege account could silently corrupt monitoring reports for other teams. The EOL status of version 2.2.0 means those users receive no patch and must upgrade.

An authenticated Checkmk user with a standard low-privilege account - one explicitly not granted the 'Edit foreign Reports' permission - navigates to or directly submits a crafted request to the report modification endpoint, referencing a report owned by another user. Because the authorization check is absent, the server accepts and applies the modification, overwriting the target report's content or configuration without any alert to the report owner.