What’s Vulnerable › Vulnerabilities

CVE-2026-39401: Privilege Escalation via update_event Job Output in Cronicle

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-07 · updated 2026-07-20
• Weakness: CWE-862

Description

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notification emails. This vulnerability is fixed in 0.9.111.

Affected products

• jhuckaby Cronicle: before 0.9.111 — fixed in 0.9.111

How to fix

Upgrade to a fixed version: jhuckaby Cronicle 0.9.111. Check the vendor advisory for mitigations.

References

• https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-5j3v-cq96-xw6v
• https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-5j3v-cq96-xw6v

Get alerted when CVE-2026-39401 or the next vulnerability affects your stack