CVE-2026-8593: Fix Business Intelligence API Pack permission

Severity: medium (CVSS 5.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-21 · updated 2026-10-24
Weakness: CWE-862

Description

Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without permissions to view and modify BI packs and rules

Affected products

Checkmk GmbH Checkmk: from 2.5.0 before 2.5.0p9; from 2.4.0 before 2.4.0p34; from 2.3.0 before 2.3.0p49 — fixed in 2.3.0p49, 2.4.0p34, 2.5.0p9

How to fix

Upgrade to a fixed version: Checkmk GmbH Checkmk 2.3.0p49, 2.4.0p34, 2.5.0p9. Check the vendor advisory for mitigations.

References

https://checkmk.com/werk/16918

Get alerted when CVE-2026-8593 or the next vulnerability affects your stack