CVE-2026-58255

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...

CVE-2026-58255 Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...

CVE-2026-58255

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with "createevents" and "runevents" privileges can inject top-level "uid" and "gid" fields through "/api/app/createevent" or "/api/app/updateevent". In...

CVE-2026-58255 Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...

CVE-2026-58255 Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...

EUVD-2026-111408

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...

CVE-2026-58255

The Cronicle multi-server task scheduler and runner (prior to version 0.9.121 ) contains a vulnerability allowing non-administrator users or scoped API keys with create_events and run_events privileges to inject top-level uid and gid fields. This occurs because lib/api.js uses validateOptionalPar...

PT-2026-127252

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with create events and run events privileges can inject top-level uid and gid fields through /api/app/create event or /api/app/update event. In...