Auth bypass in Checkmk Gmbh
CVE-2026-15227
Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users.
Vulnerability class: Broken Access Control
EPSS: 0.002 (10.9th percentile) — read the EPSS interpretation.
Affected products
- Checkmk Gmbh — versions 2.5.0, 2.4.0, 2.3.0
Weakness classification (CWE)
References
- security@checkmk.com (vendor-advisory)