CVE-2026-7485
Received Received - Intake

Incorrect Authorization in Checkmk BI Aggregations

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: Checkmk GmbH

Description
Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-7485
EUVD
EUVD-2026-63321

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
checkmk checkmk to 2.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-7485 is an authorization flaw in Checkmk where frozen BI aggregations incorrectly reveal host or service names to users with restricted access. Instead of showing proper access denied messages, unauthorized elements appear as 'Service/Host not found,' potentially exposing their existence.

Detection Guidance

Check for unauthorized access to frozen BI aggregations by reviewing logs for queries returning 'Service/Host not found' responses to restricted users. Verify if such responses reveal existence of unauthorized elements.

Impact Analysis

An authenticated user with limited visibility could discover unauthorized hosts or services they should not see. This may lead to information leakage about network structure or sensitive resources, though it does not grant direct access.

Compliance Impact

This vulnerability could violate data protection requirements by exposing unauthorized resource information, potentially compromising confidentiality. Organizations must ensure proper access controls to maintain compliance with standards like GDPR or HIPAA.

Mitigation Strategies

Disable frozen BI aggregations or revoke restricted users' access to BI aggregation views if updating Checkmk is not possible. Update to patched versions: <2.5.0p2, <2.4.0p29, or <2.3.0p47.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7485. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart