{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/checkcle/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:checkcle:checkcle:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-112292"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CheckCle (\u003c= 1.6.0)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","web-application","cve-2026-112292"],"_cs_type":"advisory","_cs_vendors":["CheckCle"],"content_html":"\u003cp\u003eCheckCle through version 1.6.0 suffers from a missing authorization vulnerability (CVE-2026-112292) stemming from the underlying use of PocketBase with default empty API rules. This misconfiguration exposes the database to unauthenticated remote attackers. An attacker can interact directly with the /api/collections/ endpoint to perform unauthorized CRUD operations on stored data. This vulnerability allows for the extraction of highly sensitive information, including server tokens and alert configurations. Furthermore, successful exploitation enables adversaries to disrupt monitoring operations by disabling alerts, tampering with status pages, or purging historical monitoring data. The simplicity of the exploit path makes this a high-impact risk for organizations relying on CheckCle for infrastructure oversight.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker performs reconnaissance to identify a CheckCle instance exposed to the internet.\u003c/li\u003e\n\u003cli\u003eAttacker probes the /api/collections/ endpoint to determine if PocketBase is accessible without authentication.\u003c/li\u003e\n\u003cli\u003eAttacker identifies available collections by querying the API catalog.\u003c/li\u003e\n\u003cli\u003eAttacker crafts HTTP GET or POST requests to retrieve or modify records within identified collections.\u003c/li\u003e\n\u003cli\u003eAttacker exfiltrates sensitive data, such as \u003ccode\u003eserver_token\u003c/code\u003e values and \u003ccode\u003ealert_configurations\u003c/code\u003e secrets, via API responses.\u003c/li\u003e\n\u003cli\u003eAttacker modifies or deletes records to disable security alerting or manipulate incident status pages.\u003c/li\u003e\n\u003cli\u003eAttacker successfully disrupts system monitoring and achieves unauthorized persistence through configuration tampering.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability carries a CVSS 3.1 base score of 9.8. Exploitation leads to full unauthorized access to monitored infrastructure data. This can result in complete loss of confidentiality regarding server tokens and alert mechanisms, as well as loss of integrity and availability of monitoring status and alerting systems. Any organization using CheckCle version 1.6.0 or earlier is potentially exposed to data theft and the weaponization of the monitoring platform itself.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade CheckCle to the latest available version beyond 1.6.0 immediately to resolve the improper PocketBase configuration.\u003c/li\u003e\n\u003cli\u003eImplement strict network access controls (e.g., VPN or IP allowlisting) to restrict access to the /api/collections/ endpoint to authorized internal segments only.\u003c/li\u003e\n\u003cli\u003eDeploy the webserver-based Sigma rule provided in this brief to detect unauthorized API access patterns targeting the /api/collections/ endpoint.\u003c/li\u003e\n\u003cli\u003eConduct an audit of existing CheckCle data for signs of unauthorized access or modification, focusing on records within \u003ccode\u003ealert_configurations\u003c/code\u003e and \u003ccode\u003estatus_pages\u003c/code\u003e.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T16:07:52Z","date_published":"2026-10-19T16:07:52Z","id":"https://feed.craftedsignal.io/briefs/2026-10-checkcle-auth-bypass/","summary":"CheckCle versions up to 1.6.0 contain a critical missing authorization vulnerability allowing unauthenticated access to database records via improperly configured PocketBase API rules.","title":"Missing Authorization Vulnerability in CheckCle","url":"https://feed.craftedsignal.io/briefs/2026-10-checkcle-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - CheckCle","version":"https://jsonfeed.org/version/1.1"}