CVE-2026-112292 Details
Description
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.
A missing authorization vulnerability has been identified in CheckCle versions through 1.6.0. This vulnerability allows unauthenticated attackers to read, modify, and delete records due to PocketBase collections being shipped with empty API rules. As a result, attackers can exploit the /api/collections/<name>/records endpoints to access sensitive information such as server_token values and alert_configurations secrets. Additionally, they can disable alerting, alter status pages, or delete monitoring data.
Users can update the API rules for each affected collection to require authentication. This can be done through the PocketBase Admin UI or by modifying the collection rules in the 'pb_schema_latest.json' file and re-importing it.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/operacle/checkcle/blob/v1.6.0/application/public/upload/data/pb_schema_latest.json | [email protected] | Source CodeVendor |
| https://github.com/operacle/checkcle/commit/f2c338ced9162b7820b2495e298d5578df92bf75 | [email protected] | Source CodeVendor |
| https://github.com/operacle/checkcle/issues/214 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/checkcle-through-1.6.0-missing-authorization-via-empty-pocketbase-api-rules | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| operacle CheckCle | <= 1.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |