CVE-2026-7765

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.5.0p5

Description Incorrect authorization in the User Messages dashboard widget allows an attacker with a valid public dashboard share token to read the personal messages of the dashboard creator. This occurs because the message-fetching endpoints return the issuer's messages instead of the viewer's. The issue can be exploited by sending requests to the underlying endpoint, regardless of whether a User Messages widget is present on the dashboard.

Recommendations Update to version 2.5.0p5.