CVE-2026-7765
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Checkmk before version 2.5.0p5 has an incorrect authorization vulnerability in the User Messages dashboard widget. Message-fetching endpoints return the dashboard creator's messages instead of the viewer's, allowing an attacker with a valid public dashboard share token to read the issuer's personal messages.
Risk Assessment
An attacker can read private messages of a user, compromising internal communication confidentiality and potentially exposing sensitive organizational information.
Recommendation
Update Checkmk to version 2.5.0p5 or later. Restrict access to public dashboard share tokens.
Other vulnerabilities in Checkmk
See all- CVE-2025-64998High
In Checkmk versions <2.4.0p23, <2.3.0p45, and 2.2.0, there is a vulnerability related to the exposure of the session signing secret. An administrator of a remote site with config sync enabled can hijack sessions on the central site by forging session cookies.
- CVE-2026-17548Medium
Missing authorization in Checkmk versions <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to view that job's status and results.
- CVE-2026-15576Medium
Improper authentication in the agent receiver of Checkmk before 2.5.0p10 allows an unauthenticated remote attacker to bypass mutual TLS client certificate verification of relay endpoints by supplying a fixed placeholder identity in the request URL, resulting in limited impact on integrity and availability. Only Cloud, Ultimate, and Ultimate MT editions are affected.
- CVE-2026-7485Low
An incorrect authorization vulnerability in frozen BI aggregations in Checkmk (versions <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0) allows an authenticated user with restricted host and service visibility to learn the names and existence of hosts and services they are not authorized to see.
- CVE-2026-15227Medium
Missing authorization in Checkmk before versions 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users.
- CVE-2026-8593Medium
Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules.
- CVE-2026-14852Medium
A privilege escalation vulnerability in Checkmk allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. The mk_sap_hana agent plugin, running as root, derives instance identifiers from the process list and uses them to build a command executed with elevated privileges.
- CVE-2026-9549Medium
Stored XSS in service discovery active check output in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an admin to inject malicious HTML/JavaScript into check output.
- CVE-2026-8833Medium
Improper neutralization of HTML-encoded characters in URL validation in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an authenticated user to bypass URL validation and inject malicious URLs like javascript: URIs, leading to XSS.
- CVE-2026-8078Medium
Stored XSS in global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 allows an admin to store malicious HTML/JavaScript in changelog messages.
Original NVD description (English source)
Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messages rather than the viewer's, allowing an attacker who knows a valid public dashboard share token to read the issuer's personal messages by sending requests to the underlying endpoint, even without a User Messages widget present.