CVE-2026-112292
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete recor
CVSS
9.8
Crítico
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 19 oct 2026 · Última mod.: 19 oct 2026 · CWE-862
Sin historial EPSS suficiente todavía.
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.
- github.comhttps://github.com/operacle/checkcle/blob/v1.6.0/application/public/upload/data/pb_schema_latest.json
- github.comhttps://github.com/operacle/checkcle/commit/f2c338ced9162b7820b2495e298d5578df92bf75
- github.comhttps://github.com/operacle/checkcle/issues/214
- www.vulncheck.comhttps://www.vulncheck.com/advisories/checkcle-through-1.6.0-missing-authorization-via-empty-pocketbase-api-rules
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1128345.3 MED—
———Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0.4hCVE-2026-9589——
———Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't authorized to access, including other users, other accounts and, in Unblu Cloud, other customers' accounts, via configuration read and write operations that target those entities.
The Collaboration Server doesn't check whether the user reading or changing configuration has access to the entity the configuration belongs to. With certain non-default configuration validation settings, a registered user can additionally write configuration properties they aren't allowed to edit, in any scope.
Exploitation requires an authenticated session but no user interaction.8hCVE-2026-1127874.3 MED—
———OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.8hCVE-2026-1127865.4 MED—
———OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported candidate, company, and contact records.5hCVE-2026-1127854.3 MED—
———OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.8hCVE-2026-1127844.3 MED—
———OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any recipient with a spoofed From address.5h