CVE-2026-24096CWE-280

Insufficient permission validation on multiple REST API Quick Setup endpoints

Medium · published April 1, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
13.8
In the wild
Unconfirmed
What it is

Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 allows low-privileged users to perform unauthorized actions or obtain sensitive information

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00236 · 13.8th percentile
Weakness
CWE-280 · Improper Handling of Insufficient Permissions or Privileges
Published
2026-04-01T10:07Z
EPSS history
Timeline
  • 01 APR 10:07Z
    Insufficient permission validation on multiple REST API Quick Setup endpoints
    cvelistv5