# CVE-2026-8593: Checkmk improper permission enforcement in Business Intelligence API

Source: https://junglewise.ai/threats/cve-2026-8593-checkmk-improper-permission-enforcement-in-business-intelligence  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-8593 · Severity: info · CVSS 5.3 · Published 2026-07-21

Checkmk is an IT infrastructure monitoring platform used to track the health of servers and networks. A security flaw in its Business Intelligence (BI) component allows users with limited access to view or modify monitoring rules they should not be able to reach. This could lead to unauthorized changes in how business-critical services are monitored or the deletion of important configuration data.

## Quick answers

**Is CVE-2026-8593 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8593 being exploited in the wild.

**How severe is CVE-2026-8593?** Informational severity, with a CVSS score of 5.3, published 21 July 2026.

**Which products and versions are affected?** Checkmk GmbH Checkmk 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, 2.2.0 (EOL).

**Is there a fix for CVE-2026-8593?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-8593 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-8593?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization check (CWE-862) exists in the Checkmk REST API regarding Business Intelligence (BI) packs. Specifically, the API failed to respect pack-level permissions, allowing authenticated users with general BI access to view, modify, or delete rules within packs they were not authorized to manage. An attacker requires network access to the API and low-level user privileges ('Business Intelligence rules and aggregations' and 'Make changes, perform actions' permissions) to exploit this. The vulnerability is addressed in versions 2.5.0p9, 2.4.0p34, and 2.3.0p49.

## Affected products

- Checkmk GmbH Checkmk 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, 2.2.0 (EOL)

## Timeline

- 2026-05-21: advisory: Vendor advisory Werk #16918 published
- 2026-07-21: disclosed: CVE published to NVD

## References

- [https://checkmk.com/werk/16918](https://checkmk.com/werk/16918)