CVE-2026-7765
Full vulnerability record from the local CVENow database.
Description
Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messages rather than the viewer's, allowing an attacker who knows a valid public dashboard share token to read the issuer's personal messages by sending requests to the underlying endpoint, even without a User Messages widget present.
Severity
MEDIUM
CVSS score
6.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-06-08 13:16:33.627000
Last modified
2026-10-23 22:10:00.160000
View original CVE JSON
{
"id": "CVE-2026-7765",
"sourceIdentifier": "[email protected]",
"published": "2026-06-08T13:16:33.627",
"lastModified": "2026-10-23T22:10:00.160",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messages rather than the viewer's, allowing an attacker who knows a valid public dashboard share token to read the issuer's personal messages by sending requests to the underlying endpoint, even without a User Messages widget present."
},
{
"lang": "es",
"value": "Autorización incorrecta en el widget del panel de control de Mensajes de Usuario en Checkmk anterior a 2.5.0p5 provoca que los puntos finales de recuperación de mensajes devuelvan los mensajes del creador del panel de control en lugar de los del espectador, permitiendo a un atacante que conoce un token de compartición de panel de control público válido leer los mensajes personales del emisor enviando solicitudes al punto final subyacente, incluso sin un widget de Mensajes de Usuario presente."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Checkmk GmbH",
"product": "Checkmk",
"defaultStatus": "unaffected",
"versions": [
{
"version": "2.5.0",
"lessThan": "2.5.0p5",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-08T13:04:52.177100Z",
"id": "CVE-2026-7765",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:checkmk:checkmk:2.5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "7797AFCE-3FF9-497C-AEA9-D6CF170F056D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:checkmk:checkmk:2.5.0:b1:*:*:*:*:*:*",
"matchCriteriaId": "F8943BB3-1487-494C-B4EB-89EB0B18B6A2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:checkmk:checkmk:2.5.0:b2:*:*:*:*:*:*",
"matchCriteriaId": "5342045D-CB9F-4663-9538-8B657C9AC833"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:checkmk:checkmk:2.5.0:b3:*:*:*:*:*:*",
"matchCriteriaId": "E9566834-D4EE-4104-AD60-7988FCF17224"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:checkmk:checkmk:2.5.0:p1:*:*:*:*:*:*",
"matchCriteriaId": "F53BB4AD-54A6-4A77-868A-D6972DDF0EAA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:checkmk:checkmk:2.5.0:p2:*:*:*:*:*:*",
"matchCriteriaId": "0405E40E-7969-49B3-90EC-98A982464275"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:checkmk:checkmk:2.5.0:p3:*:*:*:*:*:*",
"matchCriteriaId": "629E039F-1C52-48DF-A952-11220A890AC2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:checkmk:checkmk:2.5.0:p4:*:*:*:*:*:*",
"matchCriteriaId": "CDC5BD88-F1D9-4ED4-81AA-3E6CD9AF16A8"
}
]
}
]
}
],
"references": [
{
"url": "https://checkmk.com/werk/19815",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}