CVE-2026-7485

Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see.

CVSS

No CVSS.

References

Link	Resource
https://checkmk.com/werk/16917

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary	(es) Autorización incorrecta en agregaciones BI congeladas en Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, y todas las versiones 2.2.0 permite a un usuario autenticado con visibilidad restringida de hosts y servicios conocer los nombres y la existencia de hosts y servicios que no están autorizados a ver.	(es) Autorización incorrecta en agregaciones BI congeladas en Checkmk anterior a 2.5.0p2, anterior a 2.4.0p29, anterior a 2.3.0p47, y todas las versiones 2.2.0 permite a un usuario autenticado con visibilidad restringida de hosts y servicios conocer los nombres y la existencia de hosts y servicios que no están autorizados a ver.

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Autorización incorrecta en agregaciones BI congeladas en Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, y todas las versiones 2.2.0 permite a un usuario autenticado con visibilidad restringida de hosts y servicios conocer los nombres y la existencia de hosts y servicios que no están autorizados a ver.

Information

Published : 2026-08-20 13:19

Updated : 2026-10-23 22:10

NVD link : CVE-2026-7485

Mitre link : CVE-2026-7485

CVE.ORG link : CVE-2026-7485

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-7485", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7485", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T13:27:22.878774Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@checkmk.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@checkmk.com", "affectedData": [{"vendor": "Checkmk GmbH", "product": "Checkmk", "versions": [{"status": "affected", "version": "2.5.0", "lessThan": "2.5.0p2", "versionType": "semver"}, {"status": "affected", "version": "2.4.0", "lessThan": "2.4.0p29", "versionType": "semver"}, {"status": "affected", "version": "2.3.0", "lessThan": "2.3.0p47", "versionType": "semver"}, {"status": "affected", "version": "2.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-20T13:19:07.817", "references": [{"url": "https://checkmk.com/werk/16917", "source": "security@checkmk.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@checkmk.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see."}, {"lang": "es", "value": "Autorizaci\u00f3n incorrecta en agregaciones BI congeladas en Checkmk anterior a 2.5.0p2, anterior a 2.4.0p29, anterior a 2.3.0p47, y todas las versiones 2.2.0 permite a un usuario autenticado con visibilidad restringida de hosts y servicios conocer los nombres y la existencia de hosts y servicios que no est\u00e1n autorizados a ver."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "security@checkmk.com"}