CVE-2026-24095: Missing Permission Check on Analyze Configuration Page

Severity: medium (CVSS 5.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-09 · updated 2026-06-17
Weakness: CWE-862

Description

Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p21, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows users with the "Use WATO" permission to access the "Analyze configuration" page by directly navigating to its URL, bypassing the intended "Access analyze configuration" permission check. If these users also have the "Make changes, perform actions" permission, they can perform unauthorized actions such as disabling checks or acknowledging results.

Affected products

Checkmk GmbH Checkmk: from 2.4.0 before 2.4.0p21; from 2.3.0 before 2.3.0p43; 2.2.0 — fixed in 2.3.0p43, 2.4.0p21

How to fix

Upgrade to a fixed version: Checkmk GmbH Checkmk 2.3.0p43, 2.4.0p21. Check the vendor advisory for mitigations.

References

https://checkmk.com/werk/19032

Get alerted when CVE-2026-24095 or the next vulnerability affects your stack