This vulnerability in Checkmk arises from missing authorization checks, enabling users with limited privileges to access and modify business intelligence (BI) packs and rules they should not have permission to handle. The affected versions explicitly include 2.5.0, 2.4.0, and 2.3.0. The CVSS 4.0 base score is 5.3, indicating a medium impact with network attack vector, low complexity, no user interaction, and requiring low privileges. The vendor has not provided a remediation level or patch information at this time.

Users without appropriate permissions can view and modify BI packs and rules, potentially leading to unauthorized changes in monitoring configurations or data interpretation within Checkmk. This could affect the integrity and confidentiality of monitoring data and configurations but does not indicate direct system compromise or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user access to trusted personnel only and monitor for unauthorized configuration changes. Avoid granting unnecessary privileges to users to limit exposure.