User Messages widget leaked issuer messages on shared dashboards
CVE-2026-7765

6.3MEDIUM

Key Information:

Vendor

Checkmk Gmbh

Status
Checkmk
Vendor
CVE Published:
8 June 2026

What is CVE-2026-7765?

Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messages rather than the viewer's, allowing an attacker who knows a valid public dashboard share token to read the issuer's personal messages by sending requests to the underlying endpoint, even without a User Messages widget present.

Affected Version(s)

Checkmk 2.5.0 < 2.5.0p5

References

https://checkmk.com/werk/19815
vendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.