Werk #19887: "Disabled services" ruleset ignored the "Disabled services" discovery permission
| Component | Setup | ||||||||
| Title | "Disabled services" ruleset ignored the "Disabled services" discovery permission | ||||||||
| Date | Oct 2, 2026 | ||||||||
| Level | Trivial Change | ||||||||
| Class | Security Fix | ||||||||
| Compatibility | Incompatible - Manual interaction might be required | ||||||||
| Checkmk versions & editions |
|
A role with "Manage services", but without "Rulesets", could create, edit and delete Disabled services rules through the Setup search or a direct link to the ruleset, even if "Service discovery: Disabled services" had been removed from it. Such a rule disables services just like the service discovery does, which the role was not permitted to do.
Roles without "Rulesets" now need both "Manage services" and "Service discovery: Disabled services" to open the Disabled services ruleset. Without the latter, they can no longer view or change these rules, nor re-enable disabled services in the service discovery. Grant "Service discovery: Disabled services" to roles that should keep doing so. The REST API was not affected.
Who's Affected:
All editions are affected, but only in combination with custom roles. The built-in roles are not: "Administrator" and "Normal monitoring user" hold all of these permissions, and "Guest user" holds neither "Manage services" nor "Rulesets". A site is affected if it has a role that keeps "Manage services" while "Rulesets" and "Service discovery: Disabled services" have been removed from it, and a user of that role has write access to at least one folder.
Affected Versions:
- 2.5.0
- 2.4.0
- 2.3.0
- 2.2.0 (EOL)
Mitigations:
If updating is not possible, remove "Manage services" from every role that should not be able to disable services. Note that this removes access to the service discovery as a whole for those roles.
Vulnerability Management:
We have rated the issue with a CVSS Score of 2.3 Low
(CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N) and assigned
CVE-2026-90956.