CheckCle 1.6.0 Flaw Lets Attackers Steal Secrets and Delete Data
A critical vulnerability in CheckCle allows unauthenticated users to manipulate records and access sensitive tokens due to missing authorization rules.
Key points
- CVE-2026-112292 is rated CVSS 9.3 Critical by the National Vulnerability Database.
- The flaw affects CheckCle versions through 1.6.0 shipped by vendor operacle.
- Attackers can read, modify, or delete records via exposed API endpoints.
The National Vulnerability Database has published CVE-2026-112292, a critical security flaw in the CheckCle monitoring tool. This vulnerability allows unauthenticated attackers to read, modify, and delete records because the software ships with empty API rules for PocketBase collections.
At a glance
- CVE
- CVE-2026-112292
- Product
- operacle checkcle
- CVSS
- 9.3 Critical
- Weakness
- missing authorization
- Exploited
- No known exploitation
The issue stems from CWE-862, a missing authorization weakness. According to the NVD record, the default configuration fails to restrict access to sensitive data. This oversight enables remote attackers to interact with the application without any form of authentication or credentials.
Technical Details and Impact
The vulnerability carries a CVSS score of 9.3, which the NVD classifies as Critical. Attackers can exploit the flaw by querying specific API endpoints, such as /api/collections/<name>/records. These endpoints are accessible to anyone on the network without proper authorization checks.
By accessing these endpoints, threat actors can steal server_token values and alert_configurations secrets. The NVD record states that attackers can also disable alerting mechanisms, alter status pages, or delete monitoring data entirely. This gives adversaries significant control over the monitoring infrastructure.
Affected Versions and Scope
The vulnerability affects operacle CheckCle versions up to and including 1.6.0. The NVD record specifies that these versions contain the missing authorization vulnerability by default. Any deployment using these versions with default settings is potentially exposed to unauthorized access.
The flaw is inherent in the shipped configuration of PocketBase collections. Because the API rules are empty, the application does not enforce any restrictions on who can view or change data. This makes the system vulnerable to immediate exploitation upon deployment.
What should you do?
No fix has been confirmed yet according to the source material. Administrators should immediately audit their CheckCle installations to check for unauthorized access. Reviewing API logs for suspicious queries to record endpoints is essential for detecting active exploitation.
WHAT TO DO:
- Check if your CheckCle version is 1.6.0 or earlier and review access logs for unauthorized API calls.
- Implement network-level restrictions to limit access to the /api/collections endpoints to trusted IPs only.
- Monitor for changes to alert configurations or status pages that you did not initiate.
- Prepare to apply vendor updates once a patch for CVE-2026-112292 becomes available.
What to do and how to stay safe: CheckCle
- Vulnerability severity scores ignore your specific architecture and context.
- Exploitability depends on network exposure and user behavior, not just code flaws.
- Prioritization requires continuous asset inventory and threat intelligence alignment.
Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-112292?
The National Vulnerability Database rates the vulnerability as CVSS 9.3, which is classified as Critical.
Which versions of CheckCle are affected by this flaw?
The vulnerability affects operacle CheckCle versions through 1.6.0, as stated in the NVD record.
Can an attacker delete data using this vulnerability?
Yes, the NVD record indicates that unauthenticated attackers can delete monitoring data via exposed API endpoints.
