CVE-2026-112292
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated…
- Risk score
- 69/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- CheckCle through 1.6.0 has a missing authorization vulnerability allowing unauthenticated attackers to read, modify and delete records. Attackers can steal sensitive data, disable alerting, alter status pages, or delete monitoring data.
- Affected
- {'products': ['CheckCle'], 'packages': [], 'versions': ['1.6.0']}
- Fix
- Check the linked advisory for a fix; upgrade to a fixed version if available.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
- https://github.com/operacle/checkcle/blob/v1.6.0/application/public/upload/data/pb_schema_latest.json
- https://github.com/operacle/checkcle/commit/f2c338ced9162b7820b2495e298d5578df92bf75
- https://github.com/operacle/checkcle/issues/214
- https://www.vulncheck.com/advisories/checkcle-through-1.6.0-missing-authorization-via-empty-pocketbase-api-rules
Original description
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.
Last activity 19 Oct 2026. Patch Forecast updates every hour.