CVE-2026-112292

CRITICAL 9.8

CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.

CWE	CWE-862
Vendor	operacle
Product	checkcle
Published	Oct 19, 2026
Last Updated	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for operacle checkcle

Be the first to know when new critical vulnerabilities affecting operacle checkcle are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

operacle / checkcle

0 ≤ 1.6.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/operacle/checkcle/issues/214 github.com: https://github.com/operacle/checkcle/commit/f2c338ced9162b7820b2495e298d5578df92bf75 github.com: https://github.com/operacle/checkcle/blob/v1.6.0/application/public/upload/data/pb_schema_latest.json vulncheck.com: https://www.vulncheck.com/advisories/checkcle-through-1.6.0-missing-authorization-via-empty-pocketbase-api-rules

Credits

lighthousekeeper1212 🔍 leediay153 from Viettel Post