CVE-2026-7485CWE-863broken-access-control

CVE-2026-7485

published August 20, 2026

CVSS

2.3

EPSS

Percentile

27.5

In the wild

Unconfirmed

What it is

Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see.

The record

Technical detail

CVSS: 2.3 · NONE
CVSS v4.0: 2.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00351 · 27.5th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2026-08-20T17:19Z

References (1)

https://checkmk.com/werk/16917 · [email protected]

EPSS history

Timeline

20 AUG 12:12Z
Frozen BI aggregations leak host and service names to unauthorized users
cvelistv5