Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck

CVE-2026-112292CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules

Critical 9.8

In plain English

A critical-severity missing authorization in checkcle from operacle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.3%top 71.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.

Affected products (as reported)

Vendor	Product	Versions
operacle	checkcle	0 – through 1.6.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/operacle/checkcle/issues/214 issue-tracking
https://github.com/operacle/checkcle/commit/f2c338ced9162b7820b2495e298d5578df92bf75 patch
https://github.com/operacle/checkcle/blob/v1.6.0/application/public/upload/data/pb_schema_latest.json technical-description
VulnCheck Advisory: CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules third-party-advisory