CheckCle: Missing authorization via empty PocketBase API rules

Summary

CheckCle through version 1.6.0 ships PocketBase collections with empty API rules, so the access checks are not enforced. An unauthenticated remote attacker can query the collection record endpoints to read server_token values and alert configuration secrets, modify or disable alerting, alter status pages, or delete monitoring data. No user interaction is required.

Affected

• CheckCle through version 1.6.0 (operacle/checkcle)
• Default configuration as shipped, according to the CVE description

Fixed in

Unknown. No fixed version has been confirmed. The fix commit f2c338ced9162b7820b2495e298d5578df92bf75 is referenced by the CVE, but the release containing it could not be verified.

Workaround

• Do not expose the instance to the internet; restrict access via VPN, management network or firewall/reverse proxy allow-list
• Place an authentication layer in front of the application where possible
• Rotate server_token values and alert/notification secrets that may have been exposed
• Review logs for unauthenticated requests to /api/collections/ paths and check for changed or deleted data
• Test restricting the collection rules to authenticated access before applying it, and back up pb_data first

Exploitation

• Not known to be exploited in the wild, according to the sources reviewed
• CISA SSVC: exploitation none, automatable yes, technical impact total
• Not in the KEV catalogue; EPSS below 1%
• No public proof of concept found

Our recommendation

• Check whether CheckCle is reachable from outside your network and restrict access immediately if it is
• Apply the vendor fix once a fixed version is confirmed; until then, apply the workarounds above
• Rotate credentials and alert secrets stored in CheckCle
• Review logs and monitoring data for unauthorized changes or deletions
• Monitor the vendor issue tracker and release page for an update

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record details (OpenCVE) app.opencve.io
• VulnCheck advisory www.vulncheck.com
• Vulnerable schema file at v1.6.0 github.com
• Fix commit f2c338c github.com
• CheckCle issue #214 github.com
• VulDB entry vuldb.com
• PocketBase API rules and filters pocketbase.io
• CheckCle releases github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:16.