What’s Vulnerable › Vulnerabilities
CVE-2026-7765: User Messages widget leaked issuer messages on shared dashboards
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-08 · updated 2026-10-23
- Weakness: CWE-863
Description
Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messages rather than the viewer's, allowing an attacker who knows a valid public dashboard share token to read the issuer's personal messages by sending requests to the underlying endpoint, even without a User Messages widget present.
Affected products
- Checkmk GmbH Checkmk: 2.5.0, 2.5.0-b1, 2.5.0-b2, 2.5.0-b3, 2.5.0-p1, 2.5.0-p2 (+2)
References
Get alerted when CVE-2026-7765 or the next vulnerability affects your stack