CVE-2026-7765: User Messages widget leaked issuer messages on shared dashboards
Incorrect authorization in the User Messages dashboard widget in Checkmk <2.5.0p5 causes the message-fetching endpoints to return the dashboard creator's messages rather than the viewer's, allowing an attacker who knows a valid public dashboard share token to read the issuer's personal messages by sending requests to the underlying endpoint, even without a User Messages widget present.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Checkmkto a version that resolves this vulnerability.Fixed in 2.5.0p5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7765?
The severity of CVE-2026-7765 is medium with a CVSS score of 6.3.
How do I fix CVE-2026-7765?
To fix CVE-2026-7765, update Checkmk to version 2.5.0p6 or later.
What does CVE-2026-7765 affect?
CVE-2026-7765 affects the User Messages widget in Checkmk prior to version 2.5.0p6.
What is the risk associated with CVE-2026-7765?
The risk associated with CVE-2026-7765 is categorized as 29, indicating unauthorized access to personal messages.
What type of vulnerability is CVE-2026-7765?
CVE-2026-7765 is an authorization vulnerability that allows attackers to access issuer messages on shared dashboards.