---
id: "CVE-2026-112292"
kind: "vulnerability"
aliases: ["CVE-2026-112292"]
title: "CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read,\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "checkcle", "fixed": [], "affected": "<= 1.6.0 (all releases)", "ecosystem": "github"}]
ecosystems: []
tags: ["checkcle", "docker", "monitoring", "package", "pocketbase", "self-hosted"]
not_affected_if: ["auth-required", "custom-api-rules", "not-internet-reachable", "version-above-1.6.0"]
published_at: "2026-10-19T14:17:07+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-23T23:26:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112292", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:26:36+00:00"}]
---

# CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read,…

CheckCle (self-hosted monitoring on PocketBase) ships its data collections with all five API rules set to an empty string, which in PocketBase means anyone, including unauthenticated callers. Anyone who can reach the instance can read, change or delete monitoring data, read server_token values and alert secrets, disable alerts and edit status pages. The maintainer fixed it in source on 2026-02-26 (commit f2c338c), but v1.6.0 is still the newest release and Docker image, so no installable fixed version exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:checkcle affected <= 1.6.0 (all releases) fixed ?

## How to check

Version is not the test, since every release including v1.6.0 (the latest) is affected. Without credentials, request <host>/api/collections/servers/records and <host>/api/collections/alert_configurations/records. If either returns records, the collections are open. Or in the PocketBase admin UI, check each collection's API Rules: an empty rule means public, locked means superusers only.

## Fix

No fixed release as of 2026-10-23 (latest v1.6.0). Contain: do not expose the instance to the internet; put it behind a VPN, allowlist or authenticating proxy. Fix the schema: apply the migrations from commit f2c338c (server/pb_migrations/) or set list/view/create/update/delete rules on every data collection to '@request.auth.id != ""' (or superusers only) in the PocketBase admin UI. Their down migration restores empty rules, so do not roll back. Rotate server_token values and alert secrets if the instance was reachable, and check alert configs and status pages for tampering.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112292
- 2026-10-23T23:26:36+00:00 analyst — VulnCheck advisory + issue #214 + commit f2c338c read. Fix is in source (develop, Feb 26 2026) but no release or image since v1.6.0 (Sep 2025) carries it; the fix version is unknown. Severity Daily secondary source claims this. No exploitation reported; no PoC beyond the public issue. No social search done.

## Documents

- [advisory] VulnCheck: CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules https://www.vulncheck.com/advisories/checkcle-through-1.6.0-missing-authorization-via-empty-pocketbase-api-rules
- [describes] Severity Daily: CheckCle fix in February, no release carries it https://severitydaily.com/checkcle-cve-2026-112292-empty-pocketbase-api-rules-9-8-fix-february-no-release-since-v1-6-0/
- [discussion] checkcle #214: Unauthenticated access via empty PocketBase rules https://github.com/operacle/checkcle/issues/214
- [fix] checkcle commit f2c338c: enforce API authentication rules (fix, not in any release) https://github.com/operacle/checkcle/commit/f2c338ced9162b7820b2495e298d5578df92bf75

## From the sources

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_