The vulnerability arises from lacking proper permission checks on several Quick Setup REST API endpoints in Checkmk. A user with limited permissions can exploit this flaw to invoke operations intended for higher privilege users or to retrieve sensitive configuration data. This can lead to unauthorized actions and data disclosure, compromising the integrity and confidentiality of the monitored environment.

Checkmk from Checkmk GmbH is affected. Versions include Checkmk 2.4.0 prior to patch 2.4.0p25 and Checkmk 2.5.0 beta before 2.5.0b2. Users running these versions are vulnerable when the Quick Setup APIs are exposed.

The CVSS base score of 5.3 indicates a moderate severity. EPSS indicates the probability of exploitation is below 1 %. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, via the public or internal API endpoints, requiring only authenticated access with a low‑privilege account. Exploitation would involve sending crafted requests to the Quick Setup endpoints to bypass permission checks.