Host and service name disclosure via frozen aggregations

Incorrect authorization in frozen BI aggregations in Checkmk allows remote authenticated users to read hidden host and service names. When a restricted user queries a frozen aggregation, elements outside that user's host or service visibility are rendered as "Service/Host not found" instead of being hidden, which reveals that those objects exist and discloses their names. Exposure requires a valid low-privilege account and deployments that use frozen BI aggregations, and the published impact is limited to unauthorized metadata disclosure across the affected 2.2.0, 2.3.0, 2.4.0, and 2.5.0 branches.