CVE-2026-112292: CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal servertoken values and alertconfigurations secrets, disable alerting, alter status pages, or delete monitoring data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Replace the shipped empty API rules with non-empty authorization rules to prevent unauthenticated users from reading, modifying, or deleting collection records.
PocketBase collections API rules = non-empty authorization rules
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated network attacker who can reach the CheckCle PocketBase API can exploit it. No credentials or user interaction are required.
What data and functions are exposed?
Attackers can query collection record endpoints to read server_token values and alert_configurations secrets. They can also modify or delete records, including disabling alerting, altering status pages, and deleting monitoring data.
Are default deployments affected?
The issue is caused by empty API rules in shipped PocketBase collections, so deployments using those shipped collection rules are affected through CheckCle 1.6.0.
How can I check whether a deployment is exposed?
Check whether the PocketBase API is reachable and whether requests to /api/collections/<name>/records succeed without authentication. Review the deployed collection API rules for empty rules, especially for collections holding server tokens and alert configuration data.