Skip to content
CVE PROGRAM SOURCE RECORD2.3 Low

CVE-2026-7485

Frozen BI aggregations leak host and service names to unauthorized users

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Checkmk

Description

Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Checkmk GmbH Checkmk

Default version status: unaffected

  • 2.5.0 to < 2.5.0p2affected
  • 2.4.0 to < 2.4.0p29affected
  • 2.3.0 to < 2.3.0p47affected
  • 2.2.0affected

References