Executive brief
Checkmk is an IT infrastructure monitoring platform. A security flaw in its dashboard sharing feature allows an unauthorized person to read the private system messages of the user who created the dashboard share. If an attacker obtains a valid public dashboard share link, they can access the creator's personal notifications and messages, potentially exposing sensitive operational information.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the User Messages dashboard widget of Checkmk. The message-fetching endpoint (get_user_messages_token_auth.py) incorrectly returns messages belonging to the dashboard's creator (the token issuer) rather than the current viewer. An attacker who possesses a valid public dashboard share token can query this endpoint directly to retrieve the issuer's personal messages, even if the User Messages widget is not explicitly included on the shared dashboard. The issue is resolved in version 2.5.0p5 by removing the vulnerable endpoint and disabling the widget on shared dashboards.
Affected products
- Checkmk GmbH Checkmk < 2.5.0p5
Timeline
- 2026-04-30: patched: Fix released in version 2.5.0p5
- 2026-06-08: disclosed: CVE published and NVD entry created