CVE-2025-58121 - CVE House
Back to Database
Status published Medium CVE-2025-58121

Insufficient permission validation on multiple REST API endpoints

Vulnerability Description

Insufficient permission validation on multiple REST API endpoints in Checkmk 2.2.0, 2.3.0, and 2.4.0 before version 2.4.0p16 allows low-privileged users to perform unauthorized actions or obtain sensitive information

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-58121

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • PS Positive Security GmbH

References

More from Checkmk GmbH

View All →
CVE-2025-65000
Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule
Low 2.3
CVE-2025-64999
Cross-site scripting in HTML logs of Synthetic Monitoring test services
High 7.3
CVE-2025-64998
Session hijacking via exposed session signing secret in distributed Checkmk setups
High 7.3
CVE-2025-64997
Insufficient permission validation when showing agent information
Medium 6.3
CVE-2025-64996
Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output
Medium 4.8

Affected Vendor

Checkmk GmbH

View all reports →

Affected Software

Checkmk
Vulnerable Versions:
2.4.0, 2.3.0, 2.2.0

Timeline

Official Publish: November 18th, 2025
Last Modified: November 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-280

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.