Checkmk version 2.5.0 (beta) prior to 2.5.0b2 contains a stored cross‑site scripting flaw. An authenticated user who has permission to create pending changes can embed malicious JavaScript into the pending changes sidebar. When another user opens that sidebar, the injected script runs inside the victim’s browser, granting the attacker the ability to execute arbitrary code in the context of the victim’s session.

The affected product is Checkmk by Checkmk GmbH. The vulnerability is present in version 2.5.0 (beta) builds older than 2.5.0b2. No other products or versions are listed.

The CVSS score of 8.5 indicates high severity. Because exploitation requires user authentication and the ability to create pending changes, the attack surface is limited to users with that permission. The flaw is not yet listed in the CISA KEV catalog, but once credentials or privileged access are obtained, any user who views the sidebar can be impacted, making the risk significant for organizations that allow the permission.