cve.nowby Sazabi
← All vulnerabilities
CVE-2026-112292

CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Fix
Fix or patch referenced
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: none
  • Automatable: yes
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.

Affected versions

  • operacle checkcle

    through 1.6.0

References 4

GitHub · operacle/checkcle

vulncheck.com