CheckCle Default Config Flaw Lets Attackers Wipe Records and Disable Alerts
Unauthenticated access to CheckCle endpoints allows attackers to steal tokens, disable alerts, and delete records due to empty API rules in default configurations.
Key points
- CVE-2026-112292 is rated Critical with a CVSS score of 9.3.
- The vulnerability exists in CheckCle versions up to and including 1.6.0.
- Attackers can read, modify, or delete records without authentication.
CheckCle through version 1.6.0 contains a missing authorization vulnerability that exposes server tokens and alert configurations to unauthenticated attackers. This flaw allows remote actors to read, modify, or delete records by querying specific API endpoints, potentially compromising the integrity of monitoring data and status pages.
Root cause
The issue stems from shipped PocketBase collections that use empty API rules. According to the NVD record, this configuration failure is classified under CWE-862, indicating a missing authorization check. Because these rules are empty by default, the application fails to verify user permissions before processing requests to sensitive data stores.
Attack path
Exploitation involves sending HTTP requests to the `/api/collections/<name>/records` endpoints. An attacker does not need credentials to access these paths. By targeting specific collection names, they can extract `server_token` values and `alert_configurations` secrets. This access also enables them to disable alerting mechanisms, alter status page content, or delete critical monitoring data entirely.
Affected versions
- operacle CheckCle versions up to 1.6.0
Mitigation
- Review and restrict API rules for all PocketBase collections to enforce strict authorization.
- Audit server tokens and alert configurations for signs of unauthorized access or modification.
- Monitor logs for unauthenticated requests to record endpoints.
- No official patch or update has been confirmed yet by the vendor.
Detection notes
Security operations teams should monitor for unauthenticated HTTP requests targeting API record endpoints. Look for unusual data exfiltration patterns, such as large GET requests to collection URLs. Check for unexpected changes to alert configurations or status pages, which may indicate an attacker disabling notifications. Investigate any deletion events on monitoring data tables, especially if they originate from unknown IP addresses or lack associated user sessions.
Background: Data exfiltration
Data exfiltration prevention requires monitoring outbound traffic for anomalies, restricting user permissions through strict access controls, and encrypting sensitive files at rest. You must detect unusual data movement patterns early, block unauthorized transfer methods, and verify that backup systems remain intact to limit exposure during a breach.
Read the full guide: Data Exfiltration Prevention: Stop Hidden Data Theft Before It Escapes
What to do and how to stay safe: CheckCle
- Audit all API endpoints for missing authentication or authorization controls.
- Rotate any exposed server tokens or secrets immediately after detection.
- Implement network-level restrictions to limit access to management interfaces.
- Once the vendor provides an update, apply it promptly to close the gap.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-112292?
The vulnerability has a CVSS score of 9.3, which is rated as Critical.
Which versions of CheckCle are affected?
CheckCle versions up to and including 1.6.0 are affected by this flaw.
Can attackers disable alerts using this vulnerability?
Yes, attackers can disable alerting by modifying alert configurations via the exposed endpoints.
