Improper permission enforcement in Checkmk allows authenticated users to discover which hosts already exist by observing differing HTTP response codes returned from the agent-receiver/register_existing endpoint. The vulnerability, identified as CWE‑204, can enable an attacker with valid credentials to enumerate the infrastructure and gather host inventory information that should not be publicly disclosed.

The affected product is Checkmk Software from Checkmk GmbH. Vulnerable releases include all Checkmk 2.4.0 builds prior to 2.4.0p23, all Checkmk 2.3.0 builds prior to 2.3.0p43, and the End‑of‑Life 2.2.0 branch.

The CVSS v3 score is 5.3 (moderate). The EPSS score is below 1 %, indicating a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers require valid user credentials – they must be able to authenticate to the Checkmk server – to trigger the endpoint and observe the response variations. Successful exploitation would provide the attacker with a list of existing hosts, facilitating further reconnaissance or targeted attacks against the enumerated infrastructure.