CVE-2026-112292
validatedZero produced an exploit or a check.GHSA-52m4-ffr8-945g ↗EUVD-2026-104281 ↗
description
CheckCle through 1.6.0 ships PocketBase collections without API access rules. An unauthenticated remote attacker can access and modify or remove collection records, potentially exposing tokens and configuration secrets and disrupting monitoring, when those default empty rules remain in use.
mitigation
Require authentication and appropriate authorization rules for every exposed PocketBase collection, and restrict public access to the collection API. Rotate server tokens and other secrets that may have been exposed; no fixed version is recorded.
outcome
Differential: the exploit fired on the vulnerable build and stayed silent on the patched one.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-10-19 13:55Zcve_org: trigger signal, started the run
this entry in the feed
GET /api/v1/feed/CVE-2026-112292
{ "etk_id": "ETK-2026-2060", "cve_id": "CVE-2026-112292", "display_id": "CVE-2026-112292", "ghsa_id": "GHSA-52m4-ffr8-945g", "euvd_id": "EUVD-2026-104281", "status": "published", "anchor_state": "anchored", "title": "Missing authorization in CheckCle PocketBase collections", "summary": "CheckCle through 1.6.0 ships PocketBase collections without API access rules. An unauthenticated remote attacker can access and modify or remove collection records, potentially exposing tokens and configuration secrets and disrupting monitoring, when those default empty rules remain in use.", "mitigation": "Require authentication and appropriate authorization rules for every exposed PocketBase collection, and restrict public access to the collection API. Rotate server tokens and other secrets that may have been exposed; no fixed version is recorded.", "vendor": "operacle", "product": "checkcle", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 1.6.0" ], "ecosystem": null, "fixed_versions": [], "package_name": "checkcle", "purl": null } ], "cwes": [ 862 ], "cvss_score": 9.3, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "epss_score": 0.0035, "epss_percentile": 0.2684, "epss_asof": "2026-10-20", "automation": "deterministic", "check": true, "check_confidence_basis": "differential", "exploit": true, "pipeline_minutes": 30.479036566666668, "t0_at": "2026-10-19T13:55:34.097000+00:00", "signals": { "check": { "at": "2026-10-19T15:14:36.027782+00:00", "days": 0.054883458125, "is_lower_bound": false, "measured_at": "2026-10-19T13:55:34.097000+00:00", "url": null }, "exploit": { "at": "2026-10-19T15:14:36.027782+00:00", "days": 0.054883458125, "is_lower_bound": false, "measured_at": "2026-10-19T13:55:34.097000+00:00", "url": null }, "trigger_signal": { "at": "2026-10-19T13:55:34.097000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-10-19T13:55:34.097000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-112292" } } }
published 2026-10-19 14:44Z
last change 2026-10-21 03:59Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.