CVE-2026-8593

MEDIUM

Checkmk - Fix Business Intelligence API Pack Permission

Title source: rule
STIX 2.1

Description

Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory
https://checkmk.com/werk/16918

Scores

CVSS v4 5.3
EPSS 0.0021
EPSS Percentile 11.0%
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (3)
Checkmk GmbH/Checkmk 2.3.0 - 2.3.0p49
Checkmk GmbH/Checkmk 2.4.0 - 2.4.0p34
Checkmk GmbH/Checkmk 2.5.0 - 2.5.0p9
Published Jul 21, 2026
Tracked Since Jul 21, 2026