Home

Description

Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p21, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows users with the "Use WATO" permission to access the "Analyze configuration" page by directly navigating to its URL, bypassing the intended "Access analyze configuration" permission check. If these users also have the "Make changes, perform actions" permission, they can perform unauthorized actions such as disabling checks or acknowledging results.

PUBLISHED Reserved 2026-01-21 | Published 2026-02-09 | Updated 2026-02-09 | Assigner Checkmk




MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-862: Missing Authorization

Product status

Default status
unaffected

2.4.0 (semver) before 2.4.0p21
affected

2.3.0 (semver) before 2.3.0p43
affected

2.2.0 (semver)
affected

References

checkmk.com/werk/19032

cve.org (CVE-2026-24095)

nvd.nist.gov (CVE-2026-24095)

Download JSON