Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notification emails. This vulnerability is fixed in 0.9.111.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Jhuckaby |
|
No data.
No data.
References
History
Wed, 08 Apr 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Jhuckaby
Jhuckaby cronicle |
|
| Vendors & Products |
Jhuckaby
Jhuckaby cronicle |
Wed, 08 Apr 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 07 Apr 2026 20:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notification emails. This vulnerability is fixed in 0.9.111. | |
| Title | Privilege Escalation via update_event Job Output in Cronicle | |
| Weaknesses | CWE-862 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2026-04-07T20:24:06.418Z
Updated: 2026-04-08T16:14:54.345Z
Reserved: 2026-04-06T22:06:40.516Z
Link: CVE-2026-39401
Vulnrichment
Updated: 2026-04-08T16:11:38.507Z
NVD
Status : Awaiting Analysis
Published: 2026-04-07T21:17:18.547
Modified: 2026-04-08T21:27:00.663
Link: CVE-2026-39401
Redhat
No data.