PT-2026-7118 · Checkmk · Checkmk

Published 2026-02-09 · Updated 2026-02-09 · CVE-2026-24095

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Checkmk versions 2.2.0, 2.3.0 through 2.3.0p42, and 2.4.0 through 2.4.0p20

Description A flaw exists in Checkmk that relates to improper permission enforcement. Users possessing the "Use WATO" permission can access the "Analyze configuration" page directly via its URL, circumventing the necessary "Access analyze configuration" permission check. If these users also have the "Make changes, perform actions" permission, they are able to perform unauthorized actions, including disabling checks or acknowledging results.

Recommendations Update Checkmk to version 2.2.0p43 or later. Update Checkmk to version 2.3.0p43 or later. Update Checkmk to version 2.4.0p21 or later.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-24095

Affected Products

Checkmk

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-24095 · Security Note
• https://ubuntu.com/security/CVE-2026-24095 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-24095 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-24095 · Security Note
• https://t.me/CVEtracker/44219 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2020927582103822612 · Twitter Post
• https://checkmk.com/werk/19032 · Note