CVE-2026-8078 MEDIUM

CVE-2026-8078: Fix stored XSS in global settings change log

Vendor Checkmk Gmbh
Product Checkmk
Weakness CWE-79 · XSS
Published June 8, 2026
Last update June 8, 2026
View on NVD All CVEs

CVSS base score

4.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

What the vulnerability does

01Description

Stored cross-site scripting in the global settings change log in Checkmk <2.5.0p5, <2.4.0p31, <2.3.0p48, and all 2.2.0 versions allows an administrator who can change global settings to store malicious HTML or JavaScript in changelog messages that executes in other users' browsers when they view the Activate Changes page or Audit log.

Key dates

02Disclosure timeline

June 8, 2026 CVE published
June 8, 2026 Record updated