Vulnerability details

CVE-2026-112292

operacle checkcle

CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules

CVSS 4.0

9.3Critical

Official description

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.

CVSS scores

Score	Version	Source	Vector
9.3Critical	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
9.8Critical	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
operacle	checkcle	v ≤ 1.6.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/operacle/checkcle/issues/214 issue-tracking
https://github.com/operacle/checkcle/commit/f2c338ced9162b7820b2495e298d5578df92bf75 patch
https://github.com/operacle/checkcle/blob/v1.6.0/application/public/upload/data/pb_schema_latest.json technical-description
https://www.vulncheck.com/advisories/checkcle-through-1.6.0-missing-authorization-via-empty-pocketbase-api-rules third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-19
Last updated: 2026-10-19
State: Published
Assigner (CNA): VulnCheck
Kolun priority: 21 · Low

Exploit prediction (EPSS)

0.34%

Probability of exploitation in 30 days

28.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-862
Missing Authorization