Pocketbase
Monthly
Missing authorization in CheckCle through 1.6.0 leaves the bundled PocketBase collections publicly accessible, allowing unauthenticated remote attackers to read, modify, and delete monitoring records and extract secrets such as server_token and alert_configurations values. Because the flaw is present in the default shipped schema, any instance with a reachable API endpoint is exposed out of the box; successful abuse can disable alerting, alter status pages, or erase monitoring data. No public exploit was identified at time of analysis, but the default-configuration exposure and high impact justify urgent patching.
Denial of service in PocketBase versions prior to 0.22.48 (0.22.x branch) and 0.23.0 through 0.39.6 (0.23.0+ branch) allows an authenticated attacker or server misconfiguration to crash the process by triggering a panic in an internal goroutine that escapes the panic-recovery middleware. The flaw requires a network-reachable instance and low-privilege access (e.g., superuser) for the most directly reachable paths such as backup restore or view creation; public exploit code exists. Impact is limited to availability, causing process termination and requiring a restart, with no data exposure or code execution.
Missing authorization in CheckCle through 1.6.0 leaves the bundled PocketBase collections publicly accessible, allowing unauthenticated remote attackers to read, modify, and delete monitoring records and extract secrets such as server_token and alert_configurations values. Because the flaw is present in the default shipped schema, any instance with a reachable API endpoint is exposed out of the box; successful abuse can disable alerting, alter status pages, or erase monitoring data. No public exploit was identified at time of analysis, but the default-configuration exposure and high impact justify urgent patching.
Denial of service in PocketBase versions prior to 0.22.48 (0.22.x branch) and 0.23.0 through 0.39.6 (0.23.0+ branch) allows an authenticated attacker or server misconfiguration to crash the process by triggering a panic in an internal goroutine that escapes the panic-recovery middleware. The flaw requires a network-reachable instance and low-privilege access (e.g., superuser) for the most directly reachable paths such as backup restore or view creation; public exploit code exists. Impact is limited to availability, causing process termination and requiring a restart, with no data exposure or code execution.