CheckCle Missing Authorization Vulnerability Exposes Monitoring Data

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records.

The issue exists because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to access sensitive data and disrupt monitoring.

• Steal server_token values and alert_configurations secrets
• Disable alerting
• Alter status pages
• Delete monitoring data