CVE-2026-39401

MEDIUM

5.4

Description

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notification emails. This vulnerability is fixed in 0.9.111.

Details CVE

Score CVSS v3.15.4

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurNONE

Publie4/7/2026

Derniere modification4/15/2026

Sourcenvd

Observations honeypot0

Produits affectes

cronicle:cronicle

Faiblesses (CWE)

CWE-862

References

https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-5j3v-cq96-xw6v(security-advisories@github.com)

https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-5j3v-cq96-xw6v(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.