The vulnerability arises from improper validation of the reset_url parameter in the Setup in‑page search of Checkmk. An attacker can construct a URL that, when opened by an authenticated user with Setup access, forces the browser to execute arbitrary JavaScript in the user’s session or redirects the user to an arbitrary external site. The flaw provides the capability to run scripts under the user’s credentials, potentially leaking sensitive information or performing additional privileged actions, and to perform phishing or credential‑stealing attacks via the redirect.

Checkmk by Checkmk GmbH is affected in all releases before 2.5.0p15, before 2.4.0p38, before 2.3.0p51, and the 2.2.0 release (which is End‑of‑Life). Any deployment of these versions that exposes the Setup interface to users presents a risk.

The CVSS score of 8.6 indicates a high severity issue. Exploitation requires only a structured URL and does not depend on external network reachability; the attacker must trick a legitimate authenticated user into clicking the offered link or form. Because EPSS data are not available and the vulnerability is not listed in the CISA KEV catalog, current public evidence of exploitation is limited, but the attack vector is realistic in environments where users frequently click unknown links. The impact is scoped to the authenticated user and any data or functions accessed through that session, and it could be amplified if the compromised user is a privileged account. Organizations using these Checkmk releases should treat this as a critical priority, especially if Setup access is granted to multiple admins or if the application is exposed beyond a trusted network.