CVE-2026-85076

The Cronicle multi-server task scheduler and runner is vulnerable to privilege escalation via arbitrary environment variable injection through event parameters. Prior to version 0.9.124 , an authenticated non-admin user with run_events, create_events, or edit_events privileges can exploit lib/api...