Vulnerability · Published Jun 8, 2026 · Assigned by Checkmk

CVE-2026-7765User Messages widget leaked issuer messages on shared dashboards

Medium 6.3

In plain English

A medium-severity incorrect authorization in Checkmk from Checkmk GmbH. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.2%top 91.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messages rather than the viewer's, allowing an attacker who knows a valid public dashboard share token to read the issuer's personal messages by sending requests to the underlying endpoint, even without a User Messages widget present.

Affected products (as reported)

Vendor	Product	Versions
Checkmk GmbH	Checkmk	2.5.0 – before 2.5.0p5

Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://checkmk.com/werk/19815 vendor-advisory