Vulnerability · Published Apr 7, 2026 · Assigned by GitHub_M

CVE-2026-39401Privilege Escalation via update_event Job Output in Cronicle

Medium 5.3

In plain English

A medium-severity missing authorization in Cronicle from jhuckaby. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.2%top 91.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notification emails. This vulnerability is fixed in 0.9.111.

Affected products (as reported)

Vendor	Product	Versions
jhuckaby	Cronicle	< 0.9.111

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/jhuckaby/Cronicle/security/advisories/GHSA-5j3v-cq96-xw6v x_refsource_CONFIRM