Checkmk REST API Permission Vulnerability Allowing Unauthorized Actions and Information Access

A vulnerability exists in Checkmk versions 2.2.0, 2.3.0, and 2.4.0 prior to 2.4.0p16, due to insufficient permission validation on several REST API endpoints. This flaw enables low-privileged users to execute unauthorized actions or access sensitive information. The vulnerability affects all editions of Checkmk in the default configuration.

Impact

Exploitation of this vulnerability allows low-privileged users to bypass permission restrictions, enabling them to perform unauthorized actions or access sensitive information through the affected REST API endpoints.

Remediation

Users can upgrade to Checkmk version 2.4.0p16 to address this vulnerability. This version is compatible with all Checkmk editions.