CVE-2025-58122: Insufficient permission validation when configuring notification parameters
Published Nov 18, 2025
·Updated
Insufficient permission validation in Checkmk 2.4.0 before version 2.4.0p16 allows low-privileged users to modify notification parameters via the REST API, which could lead to unauthorized actions or information disclosure.
Affected Software
23 affected components
Checkmk Checkmk<2.4.0p16
Checkmk Checkmk=2.4.0
Checkmk Checkmk=2.4.0-b1
Checkmk Checkmk=2.4.0-b2
Checkmk Checkmk=2.4.0-b3
Checkmk Checkmk=2.4.0-b4
Checkmk Checkmk=2.4.0-b5
Checkmk Checkmk=2.4.0-b6
Checkmk Checkmk=2.4.0-p1
Checkmk Checkmk=2.4.0-p10
Checkmk Checkmk=2.4.0-p11
Checkmk Checkmk=2.4.0-p12
Checkmk Checkmk=2.4.0-p13
Checkmk Checkmk=2.4.0-p14
Checkmk Checkmk=2.4.0-p15
Checkmk Checkmk=2.4.0-p2
Checkmk Checkmk=2.4.0-p3
Checkmk Checkmk=2.4.0-p4
Checkmk Checkmk=2.4.0-p5
Checkmk Checkmk=2.4.0-p6
Checkmk Checkmk=2.4.0-p7
Checkmk Checkmk=2.4.0-p8
Checkmk Checkmk=2.4.0-p9
Event History
Nov 18, 2025
CVE Published
via MITRE·03:11 PM
Data Sourced
via MITRE·03:11 PM
DescriptionWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-58122?
CVE-2025-58122 is considered a medium severity vulnerability due to its potential for unauthorized actions by low-privileged users.
2
How do I fix CVE-2025-58122?
To fix CVE-2025-58122, upgrade Checkmk to version 2.4.0p16 or later.
3
Who is affected by CVE-2025-58122?
CVE-2025-58122 affects users of Checkmk versions prior to 2.4.0p16.
4
What can happen if CVE-2025-58122 is exploited?
Exploitation of CVE-2025-58122 may allow low-privileged users to modify notification parameters, leading to unauthorized actions or information disclosure.
5
Is CVE-2025-58122 related to any APIs?
Yes, CVE-2025-58122 involves insufficient permission validation in the REST API of Checkmk.