CVE-2026-112292
Received Received - Intake

CheckCle Missing Authorization Vulnerability in Monitoring Data

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112292
EUVD
EUVD-2026-104281

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
operacle checkcle 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CheckCle through version 1.6.0 has a missing authorization vulnerability. Unauthenticated attackers can read, modify, or delete records because the PocketBase collections shipped with the software use empty API rules. Attackers can query specific endpoints to steal sensitive values like server_token and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.

Detection Guidance

Check for unauthorized access to /api/collections/<name>/records endpoints. Monitor for unusual queries or data modifications. Inspect server_token values and alert_configurations secrets in PocketBase logs or network traffic.

Impact Analysis

This vulnerability allows attackers to gain full control over monitoring data and configurations. They can steal secrets, disable critical alerting systems, alter status pages to show false information, or delete important monitoring records. This could lead to undetected system failures or breaches going unnoticed.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating GDPR's data integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity and availability. Compliance failures could result in legal penalties and loss of trust.

Mitigation Strategies

Upgrade CheckCle to a version that enforces proper authorization rules. Restrict access to API endpoints. Rotate exposed server_token and alert_configurations secrets. Review and update PocketBase collection permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart