CVE-2026-8593 | Improper permission enforcement in Checkmk versions 2.5.0 be… | CVSS 5.3 MEDIUM

Description

Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules

Metadata

CVE ID: CVE-2026-8593
State: PUBLISHED
Assigner: Checkmk
Reserved: 2026-05-14 11:33 UTC
Published: 2026-07-21 07:20 UTC
Last updated: 2026-07-21 12:16 UTC
Primary CWE: CWE-862
CWE-862: Missing Authorization
Vendor / Product: Checkmk GmbH / Checkmk
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Checkmk GmbH	Checkmk	—	2.5.0 < 2.5.0p9, 2.4.0 < 2.4.0p34, 2.3.0 < 2.3.0p49

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	CWE-862: Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

References (1)

https://checkmk.com/werk/16918