External risk intelligence

Checkcle Missing Authorization Allows Unauthenticated Record Tampering

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-112292

The application provides status pages and monitoring data, which are typically deployed as web-accessible services. Because it exposes an API for configuration and record management that is intended to be reachable to fulfill its function as a monitoring tool, it is commonly deployed in a manner that faces a network, making it likely to be reachable from the internet or an external-facing environment.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in CheckCle software allows unauthenticated attackers to access, alter, or delete records, potentially compromising sensitive data and monitoring functions due to default API configurations.

Unauthenticated access to sensitive records and functions.
Confirms relevance and potential exposure of monitoring data.
Assess if critical monitoring systems are at risk.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by directly accessing API endpoints on a vulnerable system without needing any credentials. This is possible because the application's default settings for managing data collections do not require any authorization. By sending requests to these endpoints, an attacker can access sensitive information and manipulate records.

Unauthenticated network access is required.
Attackers query collection record endpoints.
Unauthorized access to read, modify, and delete records.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to access and manipulate records stored within PocketBase collections, potentially exposing sensitive information. When supported by the advisory, attackers may steal server tokens and alert configurations, disable alerting systems, alter status pages, or delete monitoring data.

Server tokens and alert configurations.
Querying API endpoints for records.
Disabling alerts or deleting data.

Operational Fix

Recommended remediation, mitigation, and detection steps

The CheckCle vulnerability, stemming from empty PocketBase API rules, impacts teams responsible for application security and the specific services using this technology. The immediate first step involves identifying all instances of CheckCle, determining their network exposure and business criticality, and then locating the designated owner for remediation planning.

Identify application and service owners.
Verify external reachability and criticality.
Plan remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CheckCle?

CheckCle is a monitoring tool designed to track system performance and service status. It relies on PocketBase, a lightweight backend database, to store critical configuration data and records that manage how your monitoring alerts and status pages function.

What does missing authorization mean for CVE-2026-112292?

This vulnerability is classified as CWE-862, which means the software fails to verify if a user has permission to perform an action. In this case, the application's default settings do not require a login, allowing anyone to treat the system as an administrator.

How do attackers trigger this vulnerability?

Attackers exploit this by sending standard network requests directly to the application's API endpoints. Simply querying these addresses allows them to read or delete data without needing a username or password. This bug is not triggered by user interaction; it exists whenever the default API rules remain unchanged.

Is my instance of CheckCle vulnerable?

According to Halo Surface Signal, this software is commonly deployed as an internet-facing service to provide monitoring and status updates. If your instance is reachable from the network, it is likely exposed to these unauthenticated requests, making it a high priority for review.

What should I do to secure my CheckCle deployment?

Start by identifying every instance of CheckCle running in your environment. Once located, verify if the service is exposed to the internet and assess its business importance. Consult with the service owner to prioritize remediation and ensure proper authentication rules are applied.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.