CVE-2026-58255

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with "createevents" and "runevents" privileges can inject top-level "uid" and "gid" fields through "/api/app/createevent" or "/api/app/updateevent". In...