Live › vulnerability › CVE-2026-112292
Go to dashboardCheckCle (self-hosted monitoring on PocketBase) ships its data collections with all five API rules set to an empty string, which in PocketBase means anyone, including unauthenticated callers. Anyone who can reach the instance can read, change or delete monitoring data, read server_token values and alert secrets, disable alerts and edit status pages. The maintainer fixed it in source on 2026-02-26 (commit f2c338c), but v1.6.0 is still the newest release and Docker image, so no installable fixed version exists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| checkcle | github | <= 1.6.0 (all releases) | – |
v1.6.0 (the latest) is affectedv1.6.0)@request.auth.id != "" (or superusers only) in the PocketBase admin UIEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.
This page as .md · .json · in your agent: get_signal("CVE-2026-112292")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.