Cronicle is a multi-server task scheduler and runner, with a web based front-end UI.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Apr 7, 2026 · NIST NVD

   Detected

   Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notifi

2. Jul 20, 2026 · NIST NVD

   Updated

   Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notifi

Affected

• cpe cronicle/cronicleversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-39401

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-39401

  Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization ch

  nvd.nist.gov

References

• Exploit · github.com