User enumeration in Nagvis' Checkmk MultisiteAuth before version 1.9.48 allows an unauthenticated attacker to enumerate Checkmk usernames.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/NagVis/nagvis/pull/411/commits/4acabcf9d5b2d26f390e760f59def8e163908d66 Patch
- https://www.nagvis.org/downloads/changelog/1.9.48 Release Notes, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.9 · nagvisNVD modified 2026-10-18 18:10
Affected (CPE criteria) 1
cpe:2.3:a:nagvis:nagvis:*:*:*:*:*:*:*:*
References 2
- https://github.com/NagVis/nagvis/pull/411/commits/4acabcf9d5b2d26f390e760f59def8e163908d66 Patch
- https://www.nagvis.org/downloads/changelog/1.9.48 Release Notes, Vendor Advisory