CVE-2026-39401: medium-severity vulnerability in jhuckaby Cronicle
Privilege Escalation via update_event Job Output in Cronicle
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notification emails. This vulnerability is fixed in 0.9.111.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
jhuckaby · CronicleRelated CVEs — jhuckaby Cronicle
In the same product, most dangerous first.
CVE-2026-55562CRITICALCronicle: Stored XSS in admin Activity Log via account full_name fieldEPSS 0.5%CVE-2026-58255HIGHCronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401EPSS 0.4%CVE-2026-39400MEDIUMStored XSS via Job HTML/Table Output in CronicleEPSS 0.2%CVE-2026-85076CRITICALCronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)EPSS —