{"id":"CVE-2026-112292","kind":"vulnerability","aliases":["CVE-2026-112292"],"related":[],"title":"CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read,…","description":"CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.","summary":"CheckCle (self-hosted monitoring on PocketBase) ships its data collections with all five API rules set to an empty string, which in PocketBase means anyone, including unauthenticated callers. Anyone who can reach the instance can read, change or delete monitoring data, read server_token values and alert secrets, disable alerts and edit status pages. The maintainer fixed it in source on 2026-02-26 (commit f2c338c), but v1.6.0 is still the newest release and Docker image, so no installable fixed version exists.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"checkcle","fixed":[],"affected":"<= 1.6.0 (all releases)","ecosystem":"github"}],"ecosystems":[],"tags":["checkcle","docker","monitoring","package","pocketbase","self-hosted"],"not_affected_if":["auth-required","custom-api-rules","not-internet-reachable","version-above-1.6.0"],"how_to_check":"Version is not the test, since every release including v1.6.0 (the latest) is affected. Without credentials, request <host>/api/collections/servers/records and <host>/api/collections/alert_configurations/records. If either returns records, the collections are open. Or in the PocketBase admin UI, check each collection's API Rules: an empty rule means public, locked means superusers only.","fix":"No fixed release as of 2026-10-23 (latest v1.6.0). Contain: do not expose the instance to the internet; put it behind a VPN, allowlist or authenticating proxy. Fix the schema: apply the migrations from commit f2c338c (server/pb_migrations/) or set list/view/create/update/delete rules on every data collection to '@request.auth.id != \"\"' (or superusers only) in the PocketBase admin UI. Their down migration restores empty rules, so do not roll back. Rotate server_token values and alert secrets if the instance was reachable, and check alert configs and status pages for tampering.","status":"open","published_at":"2026-10-19T14:17:07+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:04:42+00:00","updated_at":"2026-10-23T23:26:36+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:04:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","impact":"high","summary":"CheckCle through 1.6.0 ships PocketBase collections with empty API rules, so anyone on the network can call the records endpoints without logging in. An attacker can read server tokens and alert secrets, turn off alerting, change status pages, or delete monitoring data.","category":"package","who_cares":["checkcle","pocketbase","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attackers read secrets and delete monitoring data","analyst_note":"Find the fixed CheckCle release and the vendor advisory in the NVD references to confirm the fix version and the exact collection rules to set.","how_to_check":"Check the CheckCle version in use; versions through 1.6.0 are affected.\nRequest /api/collections/<name>/records without credentials and see whether data returns.\nunknown","needs_analyst":true,"not_affected_if":["version-above-1.6.0","auth-required"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00047,"input_tokens":2788,"output_tokens":382,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the fixed CheckCle release and the vendor advisory in the NVD references to confirm the fix version and the exact collection rules to set.","search":"'-02':93B '-112292':17A,20A '-2026':16A,19A '-26':94B '/api/collections':142C '/records':143C '1.6.0':3A,115C '2026':92B 'alert':77B,80B,151C,155C 'allow':10A,122C 'alter':156C 'anyon':55B,59B 'api':44B,137C 'attack':12A,124C,139C 'author':7A,119C 'caller':58B 'chang':67B 'checkcl':1A,22B,30B,113C 'checkcle':21A 'collect':40B,134C 'commit':95B 'configur':152C 'contain':4A,116C 'cve':15A,18A 'data':39B,71B,162C 'delet':69B,129C,160C 'disabl':79B,154C 'docker':23B,105B 'edit':82B 'empti':49B,136C 'endpoint':144C 'exist':112B 'f2c338c':96B 'five':43B 'fix':87B,110B 'host':29B,33B 'imag':106B 'includ':56B 'instal':109B 'instanc':64B 'maintain':86B 'mean':54B 'miss':6A,118C 'modifi':127C 'monitor':24B,34B,70B,161C 'newest':102B 'packag':25B 'page':84B,158C 'pocketbas':26B,36B,53B,133C 'queri':141C 'reach':62B 'read':14A,66B,72B,126C 'record':130C 'releas':103B 'rule':45B,138C 'secret':78B,153C 'self':28B,32B 'self-host':27B,31B 'server':73B,147C 'set':46B 'ship':37B,132C 'sourc':90B 'status':83B,157C 'steal':146C 'still':100B 'string':50B 'token':74B,148C 'unauthent':11A,57B,123C 'use':135C 'v1.6.0':98B 'valu':75B,149C 'version':111B 'vulner':8A,120C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T14:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112292","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112292","severity":null,"published_at":"2026-10-19T14:17:07+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112292:441","url":null,"severity":null,"published_at":"2026-10-23T23:26:36+00:00","modified_at":"2026-10-23T23:26:36+00:00","first_seen_at":"2026-10-23T23:26:36+00:00","fetched_at":"2026-10-23T23:26:36+00:00","note":"VulnCheck advisory + issue #214 + commit f2c338c read. Fix is in source (develop, Feb 26 2026) but no release or image since v1.6.0 (Sep 2025) carries it; the fix version is unknown. Severity Daily secondary source claims this. No exploitation reported; no PoC beyond the public issue. No social search done."}],"documents":[{"id":1963,"url":"https://www.vulncheck.com/advisories/checkcle-through-1.6.0-missing-authorization-via-empty-pocketbase-api-rules","title":"VulnCheck: CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1965,"url":"https://github.com/operacle/checkcle/issues/214","title":"checkcle #214: Unauthenticated access via empty PocketBase rules","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":1968,"url":"https://github.com/operacle/checkcle/commit/f2c338ced9162b7820b2495e298d5578df92bf75","title":"checkcle commit f2c338c: enforce API authentication rules (fix, not in any release)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1969,"url":"https://severitydaily.com/checkcle-cve-2026-112292-empty-pocketbase-api-rules-9-8-fix-february-no-release-since-v1-6-0/","title":"Severity Daily: CheckCle fix in February, no release carries it","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}