Werk #20003: Fix unauthorized users can edit foreign reports

Component

Reporting & availability

Title

Fix unauthorized users can edit foreign reports

Date

Jul 9, 2026

Level

Trivial Change

Class

Security Fix

Compatibility

Compatible - no manual interaction needed

Checkmk versions & editions

3.0.0b1 Not yet released	Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.5.0p10 Not yet released	Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.4.0p35	Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT
2.3.0p49 Not yet released	Checkmk Pro, Checkmk Ultimate, Checkmk Ultimate MT

Users without the permission Edit foreign Reports were able to edit foreign reports due to missing permission checks.

Who is Affected

All enterprise versions are affected.

Affected Checkmk Versions

2.5.0
2.4.0
2.3.0
2.2.0 (EOL)

Vulnerability Management

We have rated the issue with a CVSS Score of 5.3 MEDIUM (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) and assigned CVE-2026-15227.

We thank Jose Sharon and Pratheesh P. Narayanan (EY GmbH) for reporting this issue.

To the list of all Werks