Missing authorization in Checkmk <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a… (CVE-2026-17548)

CVE-2026-17548 describes a missing authorization vulnerability in Checkmk monitoring software versions before 2.5.0p12, 2.4.0p36, 2.3.0p50, and all 2.2.0 versions. Authenticated users who know the identifier of a background job can access the job's status and results without appropriate authorization controls. This could lead to unauthorized disclosure of potentially sensitive operational information about background jobs within the system.

The impact is limited to unauthorized viewing of background job status and results by authenticated users who know the job ID. There is no indication of privilege escalation, data modification, or remote code execution. The vulnerability could expose operational details that might aid an attacker in further reconnaissance but does not directly compromise system integrity or availability.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to trusted personnel only and avoid sharing job IDs unnecessarily.