CVE-2026-7485

Frozen BI aggregations leak host and service names to unauthorized users

State: Published
Severity: 2.3 Low
Published: Aug 20, 2026
Updated: Aug 26, 2026
Reserved: Apr 30, 2026

Description

Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	Checkmk

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
CheckmkCheckmk GmbH	2.5.0 to before 2.5.0p2Affected 2.4.0 to before 2.4.0p29Affected 2.3.0 to before 2.3.0p47Affected 2.2.0Affected

References

https://checkmk.com/werk/16917vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.