Description
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.
Published: 2026-10-19
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: Unauthorized Data Access and Modification
Action: Immediate Patch
AI Analysis

Impact

CheckCle through version 1.6.0 contains a missing authorization flaw that allows anyone to read, modify or delete PocketBase collection records without authentication. The vulnerability arises from bundled collections that use empty API rules, giving attackers unrestricted access to data. Attackers can query the /api/collections/<name>/records endpoints and retrieve sensitive values such as server_token and alert_configurations, disable alerting, alter status pages, or delete monitoring data.

Affected Systems

The affected product is Operacle CheckCle version 1.6.0. No other versions are listed as affected.

Risk and Exploitability

The CVSS score is 9.3, indicating a critical severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Inference: the attack vector is network-based, targeting the exposed PocketBase RESTful API endpoints. The vulnerability can be exploited by sending HTTP requests to the public /api/collections/<name>/records endpoints, which are unprotected by authentication, allowing an attacker to read or modify any collection record.

Generated by OpenCVE AI on October 19, 2026 at 15:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade CheckCle to a version where PocketBase collections enforce authentication or have been patched.
  • Configure PocketBase collection rules to require authentication and restrict write access where appropriate.
  • Restrict network access to the PocketBase API endpoints using firewall rules or VPN so that only trusted hosts can contact them.

Generated by OpenCVE AI on October 19, 2026 at 15:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.
Title CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-19T18:27:55.844Z

Reserved: 2026-10-19T13:25:34.423Z

Link: CVE-2026-112292

cve-icon Vulnrichment

Updated: 2026-10-19T18:27:52.107Z

cve-icon NVD

Status : Received

Published: 2026-10-19T14:17:07.903

Modified: 2026-10-19T19:17:27.960

Link: CVE-2026-112292

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T15:45:17Z

Weaknesses