CVE-2026-7485 - Frozen BI aggregations leak host and service names to unauthorized users · CoreCVE

Back Back to CVE browser

LOW

Frozen BI aggregations leak host and service names to unauthorized users

Published Aug 20, 2026

2.3

LOW

CVSS 4.0

EPSS 0.35%

Description

Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not authorized to see.

Affected products

Vendor Checkmk GmbH Product Checkmk Default
unaffected
Affected
- 2.2.0
- ≥ 2.3.0, < 2.3.0p47
- ≥ 2.4.0, < 2.4.0p29
- ≥ 2.5.0, < 2.5.0p2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Checkmk GmbH	Checkmk	unaffected	Affected 2.2.0 ≥ 2.3.0, < 2.3.0p47 ≥ 2.4.0, < 2.4.0p29 ≥ 2.5.0, < 2.5.0p2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (2)

https://checkmk.com/werk/16917
vendor-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63321
Advisory

Link	Providers	Tags
https://checkmk.com/werk/16917		vendor-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-63321		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Checkmk

Published Aug 20, 2026

Updated Aug 26, 2026

Reserved Apr 30, 2026

Link CVE-2026-7485

CISA Vulnrichment

Updated Aug 20, 2026

NVD

Status Deferred

Modified Aug 26, 2026

Link CVE-2026-7485

Red Hat

No data

ENISA EUVD

Assigner Checkmk

Published Aug 20, 2026

Updated Aug 26, 2026

Link EUVD-2026-63321

GitHub

No data