Catch up on the latest product updates, best practices, and expert insights from the Checkmk Conference #12 – Watch the livestream recordings now
back to website

Werk #16918: Fix Business Intelligence API Pack permission not respected in API requests

Component BI
Title Fix Business Intelligence API Pack permission not respected in API requests
Date May 21, 2026
Level Trivial Change
Class Security Fix
Compatibility Compatible - no manual interaction needed
Checkmk versions & editions
3.0.0b1
Not yet released 		Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.5.0p9 Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.4.0p34 Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.3.0p49
Not yet released 		Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Ultimate MT

Previously, BI rules could be deleted via REST API even as user without permissions to modify or even see the BI pack the affected BI rule is part of.

With this change, a user must have permissions to customize the affected BI pack in order to delete contained rules.

Who's Affected:

All Checkmk installations with configured Business Intelligence setup and users with both "Business Intelligence rules and aggregations" and "Make changes, perform actions" permissions.

Affected Versions:

  • 2.5.0
  • 2.4.0
  • 2.3.0
  • 2.2.0 (EOL)

Mitigations:

If updating is not possible, you need to make sure noone with access to the REST API and both "Business Intelligence rules and aggregations" and "Make changes, perform actions" permissions has knowledge about BI rule identifiers (as those are needed to construct a DELETE request).

Vulnerability Management:

We have rated the issue with a CVSS Score of 5.3 medium (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) and assigned CVE-2026-8593.

To the list of all Werks