Insufficient permission validation in Checkmk 2.4.0 before version 2.4.0p16 allows low-privileged users to modify notification parameters via the REST API, which could lead to unauthorized actions or information disclosure.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://checkmk.com/werk/18982 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · checkmkNVD modified 2026-10-19 13:10
Affected (CPE criteria) 22
cpe:2.3:a:checkmk:checkmk:2.4.0:-:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:b1:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:b2:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:b3:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:b4:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:b5:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:b6:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p1:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p10:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p11:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p12:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p13:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p14:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p15:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p2:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p3:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p4:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p5:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p6:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p7:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p8:*:*:*:*:*:*cpe:2.3:a:checkmk:checkmk:2.4.0:p9:*:*:*:*:*:*
References 1
- https://checkmk.com/werk/18982 Vendor Advisory