Skip to content
Back to search

CVE-2026-112292

CRITICAL
9.8NVD

Summary

generated automatically from NVD data

CheckCle through 1.6.0 has a missing authorization flaw (CWE-862): its shipped PocketBase collections use empty API rules, so unauthenticated users can reach the /api/collections/<name>/records endpoints. An attacker can read, modify or delete records, which allows stealing server_token values and alert_configurations secrets, disabling alerting, altering status pages, or deleting monitoring data. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.8.

NVD description

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.

Share:

CVSS v3.1 Score

9.8
/ 10.0
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Information

Published
19 oct. 2026
Updated
19 oct. 2026
Status
Received
Source
disclosure@vulncheck.com

Weaknesses (CWE)

CWE-862

References (4)

Similar CVEs

Other vulnerabilities of type CWE-862

…

Monitor your products

Get automatic alerts for every new CVE affecting your equipment.

Enable monitoring