CVE-2026-39401
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Cronicle before version 0.9.111 has a vulnerability where child processes can modify the parent event's configuration via the update_event key in JSON output without any authorization check. This allows a low-privilege user who can create and run events to change any event property, including webhook URLs and notification emails.
Risk Assessment
The risk is that an unauthorized user can take control of events, potentially leading to data leakage, unauthorized actions, or phishing attacks by modifying webhooks and notifications.
Recommendation
Immediately update Cronicle to version 0.9.111 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notification emails. This vulnerability is fixed in 0.9.111.