A logic error in the remove_password() function in Checkmk allows a low‑privileged user to cause data loss by deleting password records. The flaw is exercised through the REST API and results in the permanent removal of valid credentials, jeopardizing the integrity of user authentication data but not directly exposing confidential data or enabling code execution.

Checkmk GmbH:Checkmk versions below 2.4.0p23, below 2.3.0p43, and the 2.2.0 series (EOL) are affected. These include all builds of 2.4.0 up to p22, 2.3.0 up to p42, and any 2.2.0 release.

The CVSS score of 5.3 reflects moderate severity, and the EPSS score of <1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Likely attack progression involves a low‑privileged authenticated user sending a REST API request to remove_password(). Because the flaw is a logic error rather than an injection or buffer overflow, it requires only that the attacker has API access and can manipulate the endpoint.