CVE-2026-112292

{
  "etk_id": "ETK-2026-2060",
  "cve_id": "CVE-2026-112292",
  "display_id": "CVE-2026-112292",
  "ghsa_id": "GHSA-52m4-ffr8-945g",
  "euvd_id": "EUVD-2026-104281",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authorization in CheckCle PocketBase collections",
  "summary": "CheckCle through 1.6.0 ships PocketBase collections without API access rules. An unauthenticated remote attacker can access and modify or remove collection records, potentially exposing tokens and configuration secrets and disrupting monitoring, when those default empty rules remain in use.",
  "mitigation": "Require authentication and appropriate authorization rules for every exposed PocketBase collection, and restrict public access to the collection API. Rotate server tokens and other secrets that may have been exposed; no fixed version is recorded.",
  "vendor": "operacle",
  "product": "checkcle",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.6.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "checkcle",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0035,
  "epss_percentile": 0.2684,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": true,
  "pipeline_minutes": 30.479036566666668,
  "t0_at": "2026-10-19T13:55:34.097000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-19T15:14:36.027782+00:00",
      "days": 0.054883458125,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T13:55:34.097000+00:00",
      "url": null
    },
    "exploit": {
      "at": "2026-10-19T15:14:36.027782+00:00",
      "days": 0.054883458125,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T13:55:34.097000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-19T13:55:34.097000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T13:55:34.097000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-112292"
    }
  }
}